Manual:$wgUseAjax

Ajax: $wgUseAjax
Enable AJAX support.
Introduced in version:	1.6.0 (r13335)
Removed in version:	still in use
Allowed values:	boolean
Default value:	true false in earlier versions (pre-1.10)

Other settings: Alphabetical | By Function

Enables AJAX support. Required by some extensions and optional features.

Before 1.8.0, enabling Ajax support implicitly activated auto-suggestion for the search bar. In later versions, it has to be enabled explicitly, see $wgAjaxSearch (up to 1.13.x) or $wgEnableMWSuggest (since 1.13.0).

Security

"$wgUseAjax = true;" was a security issue in 1.6.x up to 1.9.0:

An XSS injection vulnerability was located in the AJAX support module, affecting MediaWiki 1.6.x and up when the optional setting $wgUseAjax is enabled.

There is no danger in the default configuration, with $wgUseAjax off.

If you are using an extension based on the optional Ajax module, either disable it or upgrade to a version containing the fix:

• 1.9: fixed in 1.9.3
• 1.8: fixed in 1.8.4
• 1.7: fixed in 1.7.3
• 1.6: fixed in 1.6.10

See also

• Manual:Ajax
• Manual:$wgAjaxWatch