Subject: [yaco-idsubmit-tool] Fwd: RE: [Tools-discuss] Fwd: [[email-masked]: googlebot to the rescue]

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 26 Apr 2011 15:01:47 +0200

Hi Emilio,

Please see below.  The observation is correct -- a http GET should not
have side effects, so we need to make the confirmation link return a
web page with a confirmation button (which will do the appropriate POST
which should make the actual confirmation happen.

Best,

	Henrik

-------- Original Message --------
Subject: RE: [Tools-discuss] Fwd: [[email-masked]: googlebot to the rescue]
Date: Mon, 25 Apr 2011 21:56:29 -0700
From: Dan Wing <[email-masked]>
To: 'Henrik Levkowetz' <[email-masked]>,        'Mark Nottingham' <[email-masked]>
CC: 'IETF TOOLS discussion' <[email-masked]>

> -----Original Message-----
> From: [email-masked] [mailto:tools-discuss-
> [email-masked]] On Behalf Of Henrik Levkowetz
> Sent: Saturday, March 26, 2011 2:24 AM
> To: Mark Nottingham
> Cc: IETF TOOLS discussion
> Subject: Re: [Tools-discuss] Fwd: [[email-masked]: googlebot to the
> rescue]
> 
> Hi,
> 
> The new draft submission tool doesn't have this problem. 

Just now I used the new submission tool for the first time, and it also
seemed to only need a GET to authorize the actual posting of the I-D.

-d

> I'm about to
> start merging that code to the trunk of the datatracker svn repository
> in something like 10 minutes from now, and do the first deployment
> today.
> 
> 
> Best,
> 
> 	Henrik
> 
> 
> 
> On 2011-03-23 00:25 Mark Nottingham said the following:
> > In case this hasn't been seen -- it needs to be fixed (i.e., a GET
> shouldn't have such side effects).
> >
> > Cheers,
> >
> >
> > Begin forwarded message:
> >
> >> *Resent-From: [email-masked] <mailto:[email-masked]>
> >> *From: *Stephane Bortzmeyer <[email-masked]
> <mailto:[email-masked]>>
> >> *Date: *23 March 2011 12:01:23 AM AEDT
> >> *To: *HTTP Working Group <[email-masked] <mailto:ietf-http-
> [email-masked]>>
> >> *Subject: **[[email-masked]: googlebot to the rescue]*
> >> *organization: *NIC France
> >> *archived-at: *<http://www.w3.org/mid/[email-masked]>
> >>
> >> The draft management tool apparently can change the state of a draft
> >> in response to a simple GET...
> >>
> >> Nice violation of the HTTP standard :-)
> >>
> >> *From: *Paul Vixie <[email-masked] <mailto:[email-masked]>>
> >> *Date: *19 March 2011 2:50:30 AM AEDT
> >> *To: [email-masked] <mailto:[email-masked]>
> >> *Subject: **googlebot to the rescue*
> >>
> >>
> >> i think the 0x20 draft was going nowhere in any case so cancelling
> it is fine.
> >>
> >> 148.68.249.66.in-addr.arpa domain name pointer
> >> crawl-66-249-68-148.googlebot.com <http://crawl-66-249-68-
> 148.googlebot.com>.
> >>
> >> crawl-66-249-68-148.googlebot.com <http://crawl-66-249-68-
> 148.googlebot.com> has address 66.249.68.148
> >>
> >> it's interesting that it can be done by a web crawler, though.
> >>
> >> re:
> >>
> >>
> >> *From: *IETF I-D Submission Tool <[email-masked]
> <mailto:[email-masked]>>
> >> *Date: *18 March 2011 10:36:25 PM AEDT
> >> *To: [email-masked] <mailto:[email-masked]>, [email-masked]
> <mailto:[email-masked]>, [email-masked] <mailto:[email-masked]>
> >> *Subject: **Submission of draft-vixie-dnsext-dns0x20-00 has been
> Cancelled *
> >>
> >>
> >> This message is to notify you that submission of an Internet-Draft,
> draft-vixie-dnsext-dns0x20-00, has just been cancelled by a user whose
> computer has an IP address of 66.249.68.148.
> >>
> >> The IETF Secretariat.
> >>
> >>
> >>
> >> _______________________________________________
> >> dnsext mailing list
> >> [email-masked] <mailto:[email-masked]>
> >> https://www.ietf.org/mailman/listinfo/dnsext
> >>
> >>
> >
> > --
> > Mark Nottingham http://www.mnot.net/
> >
> >
> >
> >
> >
> > _______________________________________________
> > Tools-discuss mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/tools-discuss
> _______________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss

---

From: "Emilio A. Sánchez" <[email-masked]>
Date: Tue, 26 Apr 2011 15:39:36 +0200

Hi Henrik,

    I'm going to check all the views. Some of them (like approve or 
confirm view) are used as action in POST forms but if the user makes a 
GET request by hand the view also does the work.

    By the way, it seems that the original problem was that a webcrawler 
was launching actions in the old tool, with the new tool it doesn't 
happen cause the confirmation link is send by mail and contains a 
confirmation code so no webcrawler will follow it.

    But I'm going to do the changes so we respect the HTTP standard :)

El 26/04/11 15:01, Henrik Levkowetz escribió:
> From: Dan Wing<[email-masked]>
> To: 'Henrik Levkowetz'<[email-masked]>,        'Mark Nottingham'<[email-masked]>
> CC: 'IETF TOOLS discussion'<[email-masked]>
>
>>>> *Resent-From: [email-masked]<mailto:[email-masked]>
>>>> *From: *Stephane Bortzmeyer<[email-masked]
>>>> *To: *HTTP Working Group<[email-masked]<mailto:ietf-http-
>> [email-masked]>>
>>>> *From: *Paul Vixie<[email-masked]<mailto:[email-masked]>>
>>>> *To: [email-masked]<mailto:[email-masked]>
>>>> crawl-66-249-68-148.googlebot.com<http://crawl-66-249-68-
>> 148.googlebot.com>.
>>>>
>>>> crawl-66-249-68-148.googlebot.com<http://crawl-66-249-68-
>>>> *From: *IETF I-D Submission Tool<[email-masked]
>>>> *To: [email-masked]<mailto:[email-masked]>, [email-masked]
>> <mailto:[email-masked]>, [email-masked]<mailto:[email-masked]>
>>>> [email-masked]<mailto:[email-masked]>
> yaco-idsubmit-tool mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yaco-idsubmit-tool

---

From: "Emilio A. Sánchez" <[email-masked]>
Date: Tue, 26 Apr 2011 16:55:50 +0200

Ticket #650 [1] is finished. Now any of the submission tool urls 
must change nothing in response to GET request.

    Best,

[1] http://trac.tools.ietf.org/tools/ietfdb/ticket/650