Re: Spam attack, observations, how to repair

In message <[email protected]>,
Ralf Schlatterbeck writes:
>On Fri, Jul 04, 2014 at 12:45:51PM +0200, Kay Hayen wrote:
>> I just checked with your own issue tracker, that both links work:
>> 
>> http://issues.roundup-tracker.org/file1496/roundupdb.py/
>> http://issues.roundup-tracker.org/file1496/roundupdb.py
>> 
>> The first ought to 404 from roundup in my mind.
>No, this always renders if after the fileXXX a '/' follows.

Also '/' should be allowed as in theory you can create a (RESTful)
link like:

   http://issues.roundup-tracker.org/file1496/roundupdb.py/properties/creation_date

or 

  http://issues.roundup-tracker.org/file1496/roundupdb.py/content

and in this case the trailing '/' can provide an index/menu of
possible subfunctions/actions/transitions. (Kay, IIRC your rewrites
would break this.) For example:

  http://issues.roundup-tracker.org/file1496/roundupdb.py/

could return something like:

  <properties href="http://issues.roundup-tracker.org/file1496/roundupdb.py/properties" />

  <content href="http://issues.roundup-tracker.org/file1496/roundupdb.py/content / >

to let an agent (javascript on a roundup page for example) get an
index of possible actions/state changes etc.

Now with that understanding, I claim that a trailing '/' in the
current roundup is an error.

Ralf, is there some historic reason the trailing '/' is allowed for
files given that it returns the same data as a url without the trailing
'/'? I.E> both:

http://issues.roundup-tracker.org/file1496/roundupdb.py
http://issues.roundup-tracker.org/file1496/roundupdb.py/

return the same page.

I would like the trailing / form for files to return a 404 personally
so in the future it can be used as part of a REST (or other)
interface.

Also it would be consistent with:

http://issues.roundup-tracker.org/issue2550671/ (returns 404)
http://issues.roundup-tracker.org/issue2550671 (doesn't return 404)

http://issues.roundup-tracker.org/user5/ (returns 404)
http://issues.roundup-tracker.org/user5 (doesn't return 404)

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft