BE: Use properly structured approach for Mozfest Event JSON-LD Data

richbrennan commented 2 years ago

The structured_data field added to the Promote tab of the Mozfest Primary page is a text field that is marked safe in the template. This isn't ideal because:

Its a security risk. The data can be crafted in a way that arbitrary JS can be run, note the <script> tag in the following code that fires an alert containing the text foo:

{
  "@context": "http://json-ld.org/contexts/person.jsonld",
  "@id": "http://dbpedia.org/resource/John_Lennon",
  "name": "</script><script>alert('foo');</script><script>",
  "born": "1940-10-09",
  "spouse": "http://dbpedia.org/resource/Cynthia_Lennon"
}

Its not very user friendly for a non-technical user.

There's a wagtail plugin for outputting Scheme.org data. We should investigate whether this plugin will work for the required data and implement. https://pypi.org/project/wagtail-schema.org/

┆Issue is synchronized with this Jira Task

cdanfon commented 1 year ago

This ticket would need some grooming ahead of planning.

cdanfon commented 1 year ago

Hey @tomusher can you pick this ticket please?

cdanfon commented 1 year ago

Hey @mtdenton Tom will pick this one too

tomusher commented 1 year ago

The wagtail-schema.org project helps to output Schema.org data, but doesn't help with managing it - I think we can avoid using that for this limited case in the interest of minimising dependencies.

I'd suggest we:

Remove the structured_data field
Add a start date/end date field to the Mozfest Homepage page type.
Automatically generate this schema.org data from the existing fields on this page:
- Name from the page title
- Description from the 'Meta description' field
- Image from the 'Share image'
- Start date/end date from the new fields
- Default the event status to 'scheduled', the location to 'VirtualLocation' and attendance mode to 'OnlineEventAttendanceMode'

The benefit of this change is simplicity for the editor; they don't have to worry about structured data at all and the site will just generate it for them. There's also no room for security issues.

The downside is limited flexibility - if there's a need to add custom structured data it would not be possible, but I imagine this would be a rarity.

Before I start this can we clarify if these tradeoffs are OK @cdanfon?

cdanfon commented 1 year ago

Hey @mtdenton can you make a call on the above please? Thanks!

mtdenton commented 1 year ago

@marcwalsh Do you know if Tom's response above is a dealbreaker or do you know who I could ask? This concerns what information we make readily available to search engines about our pages. Are we heavily customizing this information per page using the Structured Data field in the Promote tab? Regardless, the way that we have this set up now isn't safe so it needs to be rethought.

@tomusher Would this change be isolated to mozillafestival.org pages or will this change affect the entirety of the CMS? I'm wondering if anyone else around MoFo is using structured_data.

tomusher commented 1 year ago

@mtdenton This is isolated to mozillafestival.org pages as the structured_data field is on the MozFestPrimaryPage class that only MozFest-specific pages inherit from.

Looking at the database, the only page that use this structured_data field is the main Mozilla Festival top-level page where the structured data is:

  "@context": "https://schema.org",
  "@type": "Event",
  "name": "MozFest 2023",
  "description": "Activists in the internet health movement will gather at MozFest to move the needle in tech, art, social responsibility, ethics, and AI. Will you join us in March 2023?",
  "image": "https://assets.mofoprod.net/network/images/Instagram.original.jpg",
  "startDate": "2023-03-20T13:00+01:00",
  "endDate": "2023-03-24T23:00+01:00",
  "eventStatus": "https://schema.org/EventScheduled",
  "eventAttendanceMode": "https://schema.org/OnlineEventAttendanceMode",
  "location": {
    "@type": "VirtualLocation",
    "url": "https://schedule.mozillafestival.org"
  }
}

My example above would replicate this data exactly, but would not allow for additional customisation by the editor (new fields, different location, etc.) - we would need to add additional metadata fields for that.

cdanfon commented 1 year ago

@marcwalsh @mtdenton Any thoughts on Tom's message to unblock this issue please?

cdanfon commented 1 year ago

@bheasman for visibility

cdanfon commented 1 year ago

@marcwalsh @mtdenton bringing this one back to the top. Any thoughts on Tom's comment?

marcwalsh commented 1 year ago

Apologies I'm not sure how I missed this! I do have a big question around if this is working correctly, as Google hasn't picked this up and it's been published for a number of months now.

I think the field approach might be too restrictive - as we'll look to also add offers into the data also - this is what I'm going to update the current data to:

{
  "@context": "https://schema.org",
  "@type": "Event",
  "name": "MozFest 2023",
  "description": "Activists in the internet health movement will gather at MozFest to move the needle in tech, art, social responsibility, ethics, and AI. Will you join us in March 2023?",
  "image": "https://assets.mofoprod.net/network/images/mozilla-festival_.2e16d0ba.fill-760x760-c100.fo.original.jpg",
  "startDate": "2023-03-20T13:00+01:00",
  "endDate": "2023-03-24T23:00+01:00",
  "eventStatus": "https://schema.org/EventScheduled",
  "eventAttendanceMode": "https://schema.org/OnlineEventAttendanceMode",
  "location": {
    "@type": "VirtualLocation",
    "url": "https://schedule.mozillafestival.org"
  },
  "offers": [{
    "@type": "Offer",
    "name": "Pay What You Can",
    "price": "0",
    "priceCurrency": "EUR",
    "validFrom": "2022-12-15",
    "url": "https://www.mozillafestival.org/tickets",
    "availability": ""
  },{
    "@type": "Offer",
    "name": "MozFest Patron",
    "price": "250",
    "priceCurrency": "EUR",
    "validFrom": "2022-12-15",
    "url": "https://www.mozillafestival.org/tickets",
    "availability": ""
  }]
}

We'll potentially also be adding additional events in Amsterdam and Kenya, on separate ticket pages and use the field for structured data on those pages individually.

tomusher commented 1 year ago

It doesn't seem to be working correctly right now because there is a syntax error in the current value (https://validator.schema.org/#url=https%3A%2F%2Fwww.mozillafestival.org%2Fen%2F).

For the 'offers' section, we could add a new StreamField that builds this schema object from offers (given name, price, etc.) so that it can be managed using familiar fields/UI rather than having to write out the schema in full.

cdanfon commented 1 year ago

Hey @tomusher @marcwalsh keen to progress this further - could you confirm next steps please?

mtdenton commented 7 months ago

@cdanfon is this still relevant given the refresh work being done currently?

cdanfon commented 7 months ago

Hey @mtdenton I believe so - we're bringing a new landing page and tweaking the existing homepage. @kevinhowbrook correct me if I'm wrong!

data-sync-user commented 2 weeks ago

➤ Simon Acosta Torres commented:

Tyler Denton While there was a lot of back and forth on this ticket last year, I feel it reached a stalling point, where I don’t feel this might be as required as before. Could just remove for now.

MozillaFoundation / foundation.mozilla.org

BE: Use properly structured approach for Mozfest Event JSON-LD Data #7996