Re: Attachment spam: do we want to edit history?

In message <[email protected]>,
Ralf Schlatterbeck writes:

>On Wed, Sep 05, 2012 at 02:05:33PM -0400, John P. Rouillard wrote:
>>   http://issues.roundup-tracker.org/issue2550731
>> 
>> which apparently has been spammed with attachements. Sigh.
>> 
>> Ralf, any idea on how should I handle the attachment spam? If I just
>> delete/unlink the file from the ticket the data/link is still
>> accessible from the history.
>I've just written a script to completely remove file spam:
>http://roundup.hg.sourceforge.net/hgweb/roundup/roundup/rev/9f507a042c1b
>
>For matching spam, you *have* to give the issues involved (as designators,
>e.g., issue2550731) and you can specify exact filename, file-start, or
>username (creator) of files. It will
>- remove the file from the issue if not already deleted

By remove do you mean unlink? IIRC you can do unjournalled changes
from the api, so I assume this unlink is not recorded? Or is it just
deleted in the next step?

>- remove *all* journal (history) entries for the file for the given issue
>- set the contents of the file to zero-length
>[...]
>Before I try this out on our real tracker I'm asking all users:
>
>Do we really want to edit history in this way?
>I'm for it (for spam only).

I am also for it, but I think it would be good to leave some sort of
journal entry in the ticket to indicate that a file was removed due to
spam.

I haven't worked with the journal api in a looong time. Is there a way
to generate a journal entry that is just pure text and has no relation
to any objects? Ideally if you look at the journal it should say
something like:

   date user "file number so and so removed - attachment spam"

whithout any hyperlinks inside the " enclosed part for a web spider to
crawl.

This would provide the audit trail entry at least so if somebody
really really wanted to, they could manually construct the uri for the
file and get date and user who created the spam and other attachment
info (maybe original size??) although not contents as they are zeroed
out.

I agree with your caution of removing mistakes without noting the
change, but I think this would be a suitable workaround if the code
allows it.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/