Launchpad itself

OOPS when accessing launchpad with no referrer, eg. via wget

Bug #553361 reported by Ursula Junque
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Diogo Matsubara
Launchpad itself 10.04

Bug Description

As seen in OOPS-1551O2750:
   NoReferrerError: No value for REFERER header

<sinzui> Ursinha, someone using wget is trying to automate launchpad. He is not passing a referer so we do not trust him
<sinzui> Ursinha, gary_poster know the issue well. The user should be using API
<gary_poster> Ursinha: yes, that should not be an OOPS

Related branches

lp:~matsubara/launchpad/bug-553361-no-referrer
Francis J. Lacoste (community): Approve (release-critical)
Brad Crittenden (community): Approve (code)
Gary Poster: Pending requested
Diff: 51 lines (+21/-2)
2 files modified
lib/canonical/launchpad/webapp/errorlog.py (+1/-1)
lib/canonical/launchpad/webapp/tests/test_errorlog.py (+20/-1)
Gary Poster (gary)
Changed in launchpad-foundations:
status: New → Triaged
importance: Undecided → High
milestone: none → 10.04
Revision history for this message
Ursula Junque (ursinha) wrote :

Note: this causes about 2000 oopses a day on lpnet; not serious but annoying.

Revision history for this message
Diogo Matsubara (matsubara) wrote :

We're going to filter this out in oops-tools rather than not generating the OOPS.

affects: launchpad-foundations → oops-tools
Changed in oops-tools:
milestone: 10.04 → none
Revision history for this message
Diogo Matsubara (matsubara) wrote :

Actually it's better to fix Launchpad to not generate an OOPS when such exception is raised.

affects: oops-tools → launchpad-foundations
Diogo Matsubara (matsubara)
Changed in launchpad-foundations:
status: Triaged → In Progress
assignee: nobody → Diogo Matsubara (matsubara)
milestone: none → 10.04
Revision history for this message
Brian Murray (brian-murray) wrote :

For what it is worth it isn't possible to use the API for everything. For example, greasemonkey scripts can't - at least the last time I checked. Additionally, it isn't possible to set the referrer using greasemonkey so you might also receive some OOPS reports about a greasemonkey script.

Revision history for this message
Diogo Matsubara (matsubara) wrote :

Note to self, to reproduce this bug and further QA the fix when it lands on edge, use the following command:
wget -S --post-data 'format=PO&submit=Request+Download' https://translations.staging.launchpad.net/twisted/main/+export --no-cookies --header="Cookie: staging=<replace-for-your-staging-cookie>"

Diogo Matsubara (matsubara)
Changed in launchpad-foundations:
status: In Progress → Fix Committed
Gary Poster (gary)
Changed in launchpad-foundations:
status: Fix Committed → Fix Released
Revision history for this message
Diogo Matsubara (matsubara) wrote :

Actually this has not been released yet. Fix is on edge and staging but not lpnet. I requested a CP and will update the status once it's rolled out to lpnet.

Changed in launchpad-foundations:
status: Fix Released → Fix Committed
tags: added: qa-ok
Diogo Matsubara (matsubara)
Changed in launchpad-foundations:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.