Tue 07 Aug 2007 10:36:14 AM UTC, original submission:
VERSION:
samizdat-0.6.0.070618-1
PROBLEM:
george starts (anonymously) publishing an article with what
on his computer is a file george.jpg with his smiling face.
He hits preview, has a look at the preview, and then goes
away to have coffee.
A few moments later, ossama starts (anonymously) publishing
an article with what on his computer is a file ossama.jpg
showing his smiling face. He hits preview, has a look at the
preview, and then goes away to have coffee.
Meanwhile, back on the ranch, george comes back from coffee.
He looks at his browser screen, he sees his photo and the
button "confirm", he yells "Yeehah!" and he hits "confirm".
george then sees his name as author but... a lovely photo of
ossama instead of his own. His face goes white in shock and he
concludes that ossama has hacked into the White
House computer and he launches some nuclear warheads
into Eurasia somwhere as revenge.
ossama then gets back to his own browser, hits confirm and
gets a Runtime Error. He concludes that western technology
is crap.
ANALYSIS:
From the server, it's clear that the file upload.jpg initially
posted by george got replaced by ossama before george decided
to confirm. When george confirmed, he published ossama's picture.
When ossama confirmed, no previewed picture was available,
hence the error.
POSSIBLE SOLUTIONS:
Some modification of content.rb e.g. to the upload_id method
e.g. with some sort of digest( ) for the file names would
presumably do this. It would then be good to have something
somewhere in the system to clean up (remove) old files, e.g.
older than 1 week.
i'm not actually giving a concrete proposal right now (since i
spent quite a bit of time on a multi_publish patch coming up
soon...)
In principle, a standard temporary file creation mechanism
could be used, but see the discussion below for a
counterargument why it would be better to at least keep
previewed files for some reasonable delay due to the typical
use of samizdat. Moreover, we have to give a user some reasonable
delay to decide to confirm or not.
DISCUSSION:
If users publish after logging in, then there is less chance
that they will have a self edit conflict (though it's still
possible logically). However, anonymous users should not be
subjected to this bug.
However, there could be situations were someone posts
a photo in a hurry - e.g. from a cell phone with internet
access, and gets grabbed by the authorities before s/he
manages to hit confirm. Do we really want to "throw away"
this photo quickly? In exceptional situations (such as
government repression of a demonstration), surely it would
be better that admins can rescue such photos, even though
this would have to be an exceptional "hack", not a standard
procedure.
i put this at "blocker" level since this sort of edit
conflict could not only discourage users but also lead
to loss of useful uploads.
cheers
boud
|