| *** tpb has joined #melange | 00:00 | |
| *** Merio has quit IRC | 00:07 | |
| *** diones has quit IRC | 00:18 | |
| *** MatthewWilkes has quit IRC | 01:08 | |
| *** MatthewWilkes has joined #melange | 01:09 | |
| *** matthewwilkes_ has joined #melange | 01:54 | |
| *** matthewwilkes_ has quit IRC | 02:02 | |
| *** MatthewWilkes has quit IRC | 02:07 | |
| *** MatthewWilkes has joined #melange | 02:13 | |
| *** MatthewWilkes has quit IRC | 03:08 | |
| *** Merio has joined #melange | 10:00 | |
| *** ChanServ sets mode: +v Merio | 10:00 | |
| *** dr__house has joined #melange | 10:14 | |
| *** madrazr has joined #melange | 10:58 | |
| *** ChanServ sets mode: +v madrazr | 10:58 | |
| *** madrazr has quit IRC | 11:45 | |
| *** MatthewWilkes has joined #melange | 12:00 | |
| *** veelck has joined #melange | 13:18 | |
| *** matthewwilkes_ has joined #melange | 14:12 | |
| *** MatthewWilkes has quit IRC | 14:27 | |
| *** dr__house has quit IRC | 14:33 | |
| *** madrazr has joined #melange | 15:10 | |
| *** ChanServ sets mode: +v madrazr | 15:10 | |
| *** madrazr has quit IRC | 15:37 | |
| *** ThomasWaldmann has quit IRC | 15:41 | |
| *** ThomasWaldmann has joined #melange | 15:42 | |
| *** johndbritton has joined #melange | 16:11 | |
| *** johndbritton has quit IRC | 16:20 | |
| *** johndbritton has joined #melange | 16:20 | |
| *** johndbritton has joined #melange | 16:21 | |
| *** matthewwilkes_ is now known as MatthewWilkes | 17:24 | |
| *** johndbritton has quit IRC | 18:25 | |
| *** ThomasWaldmann has quit IRC | 18:25 | |
| *** arun has quit IRC | 18:25 | |
| *** Merio has quit IRC | 18:25 | |
| *** scorche|sh has quit IRC | 18:25 | |
| *** lisppaste9 has quit IRC | 18:25 | |
| *** veelck has quit IRC | 18:25 | |
| *** dreimark has quit IRC | 18:25 | |
| *** MatthewWilkes has quit IRC | 18:25 | |
| *** scorche has quit IRC | 18:25 | |
| *** schultmc_ has quit IRC | 18:25 | |
| *** nuba has quit IRC | 18:25 | |
| *** Erant has quit IRC | 18:25 | |
| *** durin42 has quit IRC | 18:25 | |
| *** schultmc has quit IRC | 18:25 | |
| *** johndbritton has joined #melange | 18:32 | |
| *** ThomasWaldmann has joined #melange | 18:32 | |
| *** MatthewWilkes has joined #melange | 18:32 | |
| *** veelck has joined #melange | 18:32 | |
| *** Merio has joined #melange | 18:32 | |
| *** arun has joined #melange | 18:32 | |
| *** scorche has joined #melange | 18:32 | |
| *** lisppaste9 has joined #melange | 18:32 | |
| *** scorche|sh has joined #melange | 18:32 | |
| *** schultmc_ has joined #melange | 18:32 | |
| *** dreimark has joined #melange | 18:32 | |
| *** Erant has joined #melange | 18:32 | |
| *** nuba has joined #melange | 18:32 | |
| *** irc.freenode.net sets mode: +v Merio | 18:32 | |
| *** schultmc has joined #melange | 18:33 | |
| *** durin42 has joined #melange | 18:33 | |
| *** irc.freenode.net sets mode: +v durin42 | 18:33 | |
| *** dhaun has joined #melange | 18:48 | |
| *** MatthewWilkes has quit IRC | 18:49 | |
| *** MatthewWilkes has joined #melange | 18:51 | |
| *** Lennie has joined #melange | 19:36 | |
| *** ChanServ sets mode: +o Lennie | 19:36 | |
| *** diones has joined #melange | 21:14 | |
| diones | Lennie: hi lennie | 21:15 |
|---|---|---|
| Lennie | o hi | 21:15 |
| diones | Lennie: I have copy pasted a link to a task | 21:15 |
| diones | as a admin | 21:16 |
| diones | and then tried to access it as a user | 21:16 |
| Lennie | and it failed :D | 21:16 |
| diones | it 404'd | 21:16 |
| Lennie | yeah | 21:16 |
| Lennie | I noticed that one this morning when trying it myself | 21:16 |
| diones | how did erant accessed that page? | 21:17 |
| Lennie | I guess it worked in that revision | 21:17 |
| diones | Erant: explain yourself :D | 21:17 |
| Erant | What page | 21:17 |
| Lennie | Erant you haczors :D | 21:17 |
| diones | the task list page | 21:17 |
| Lennie | diones is fixing your XSS exploit :P | 21:17 |
| Erant | Euhm | 21:17 |
| Lennie | he could just access it because back then it worked :P | 21:17 |
| Lennie | apparently something fails now | 21:18 |
| diones | hmmmmmmmmmmm | 21:18 |
| diones | I see | 21:18 |
| Erant | Regression tests ftw. | 21:18 |
| diones | well the problem solved it self xD | 21:18 |
| Lennie | it did? :P | 21:18 |
| Erant | "Impossible to perform XSS attack now" | 21:18 |
| Erant | 'Fixed' | 21:18 |
| Lennie | no :p | 21:19 |
| Lennie | nearly impossible to do POST request forgery yes :0 | 21:19 |
| diones | well we need to fix the access to tasks right? | 21:19 |
| Lennie | you could login as an org admin right? | 21:19 |
| Lennie | and view the task? | 21:19 |
| Lennie | that should be enough for this purpose | 21:20 |
| diones | yes | 21:20 |
| diones | well it seems like a feature to me | 21:21 |
| diones | in some sense | 21:21 |
| diones | the cleaner was built in a way to ignore checking if the user is logged as an administrator | 21:22 |
| diones | disabling that could result in unforeseeable consequences | 21:22 |
| Erant | orly. How exactly is this checked... | 21:23 |
| diones | http://code.google.com/p/soc/source/browse/app/soc/logic/cleaning.py#397 | 21:24 |
| tpb | <http://ln-s.net/4sFa> (at code.google.com) | 21:24 |
| diones | yarly | 21:24 |
| Lennie | hmmm | 21:26 |
| Lennie | was talking about org admin | 21:26 |
| Lennie | not developer | 21:26 |
| Lennie | which is what it skips | 21:26 |
| Erant | k. Looks fine. | 21:27 |
| Erant | Just checking. I'll probably go do more poking when there's a bit more to poke at. Not that I expect to find anything with the new security dude. | 21:28 |
| Lennie | hehe | 21:30 |
| Lennie | diones, are you able to visit the task page purely as mentor or org admin? | 21:30 |
| Lennie | not as a developer | 21:30 |
| diones | Lennie: I'll look into it | 21:49 |
| *** johndbritton has quit IRC | 21:54 | |
| Lennie | most kind diones :) | 22:16 |
| Lennie | I'm off | 22:16 |
| Lennie | ttyal | 22:16 |
| *** Lennie has quit IRC | 22:24 | |
| *** dhaun has quit IRC | 22:26 | |
| *** diones has quit IRC | 22:42 | |
| *** diones has joined #melange | 22:45 | |
| *** Merio has quit IRC | 23:14 | |
| *** diones has quit IRC | 23:51 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!