Re: Should missing templates be reported to the user or to the admin

Hi Christof:

In message <[email protected]>,
Christof Meerwald writes:
>On Tue, 19 May 2020 21:15:24 -0400, John P. Rouillard wrote:
>> However the engine thinks that .../issue3?@template=empty is a valid
>> url. It's not. There is no empty template. As a result I get an email
>> logged on every hit. The user sees a 500 error with the message:
>
>Sending an email for each request is bad - this could also be abused
>to overflow the admin's mail box.

Yup. Being able to generate an email at will isn't a good thing in this 
case.

>> I am considering trapping the NoTemplate error and sending the 
>> user the following message:
>>
>>   No template file exists for templating "issue" with template "empty"
>>     (neither "issue.foo" nor "_generic.foo")
>>
>> with a 200 or 500 status. I am leaning toward the 500 status.
>
>It definitely shouldn't be a 200 status, but I am not sure about 500
>either (it's not really a server issue). Wouldn't something in the 4xx
>range be more appropriate, maybe even a 404?

Your correct. It's not a server issue it's the client sending bad
data. My current patch is:

+        try:
+            tplname = self.selectTemplate(self.classname, self.template)
+        except templating.NoTemplate as message:
+            self.response_code = 400
+            raise NotFound('<strong>%s</strong>'%html_escape(str(message)))

which generates a 400 error. The comment for the hander for this in
client.py says:

   except NotFound as e:
       if self.response_code == 400:
           # We can't find a parameter (e.g. property name
           # incorrect). Tell the user what was raised.
           # Do not change to the 404 template since the
           # base url is valid just query args are not.
           # copy the page format from SeriousError _str_ exception.

I think this should suffice. Not sure how to test this code path though.

Thoughts?

Have a great weekend and thanks for responding.
 
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.