#380 closed defect (fixed)
webapi: remove 'mkdir-p' API since it logs pathnames
Reported by: | warner | Owned by: | warner |
---|---|---|---|
Priority: | major | Milestone: | 1.9.2 |
Component: | code-frontend-web | Version: | 1.0.0 |
Keywords: | privacy docs logging news | Cc: | |
Launchpad Bug: |
Description
We did a pass through the HTTP logging in webish.py to make sure that no pathnames or other sensitive data is recorded in the logs. The mkdir-p call got added after this pass, and needs to be fixed to not record that information.
Attachments (1)
Change History (16)
comment:1 Changed at 2008-04-25T00:21:36Z by warner
comment:2 Changed at 2008-05-05T21:08:36Z by zooko
- Milestone changed from 1.0.1 to 1.1.0
Milestone 1.0.1 deleted
comment:3 Changed at 2008-05-29T22:29:35Z by warner
- Milestone changed from 1.1.0 to 1.2.0
comment:4 Changed at 2008-05-30T02:09:55Z by warner
- Summary changed from webapi 'mkdir-p' calls should not log pathnames to webapi: remove 'mkdir-p' API since it logs pathnames
I added the new API: POST /uri/$ROOT/path/to/be/made?t=mkdir . I think the only user of the old API is the allmydata migration process, so once that is complete we can remove the t=mkdir-p API and documentation altogether.
comment:5 Changed at 2009-06-30T12:39:44Z by zooko
- Milestone changed from 1.5.0 to eventually
comment:6 Changed at 2010-01-07T01:07:07Z by davidsarah
- Keywords privacy docs added
comment:7 Changed at 2010-10-23T00:46:23Z by davidsarah
- Keywords logging added
comment:8 Changed at 2011-07-22T23:42:56Z by davidsarah
- Keywords review-needed added
- Milestone changed from eventually to soon
- Owner set to warner
comment:9 Changed at 2011-08-02T00:22:25Z by davidsarah
- Keywords news added
Proposed NEWS:
- The unused ?t=mkdir-p operation has been removed from the web-API. (`#380`_)
comment:10 Changed at 2012-05-13T02:22:12Z by Brian Warner <warner@…>
- Resolution set to fixed
- Status changed from new to closed
In eb2a4ef24611f3bc:
(The changeset message doesn't reference this ticket)
comment:11 Changed at 2012-05-13T02:22:49Z by Brian Warner <warner@…>
In eb2a4ef24611f3bc:
comment:12 Changed at 2012-05-13T02:23:51Z by warner
- Keywords review-needed removed
- Milestone changed from soon to 1.10.0
code has landed, ticket closed!
comment:13 Changed at 2012-05-16T22:38:03Z by zooko
- Milestone changed from 1.10.0 to 1.9.2
I reviewed eb2a4ef24611f3bc and didn't see any problem with it.
comment:14 Changed at 2012-05-16T22:38:16Z by zooko
- Milestone changed from 1.9.2 to 1.10.0
comment:15 Changed at 2012-05-16T22:55:55Z by davidsarah
- Milestone changed from 1.10.0 to 1.9.2
This API is removed on the 1.9.2 branch: [5462/1.9.2]. Since there are no references to it in the source or docs and since we don't want to encourage its use, I decided this was safe even for a point release.
Changing the API to be POST /uri/$ROOT/path/to/be/made?t=mkdir would take care of this automatically, since we currently censor everything between /uri and the question mark. But I think the current API is more like POST /uri/$ROOT?t=mkdir-p&path=/path/to/be/made.