Merge lp:~stub/launchpad/memcache into lp:launchpad

Proposed by Stuart Bishop
Status: Merged
Merged at revision: not available
Proposed branch: lp:~stub/launchpad/memcache
Merge into: lp:launchpad
Diff against target: 28 lines (+8/-10)
1 file modified
lib/lp/bugs/templates/bugcomment-box.pt (+8/-10)
To merge this branch: bzr merge lp:~stub/launchpad/memcache
Reviewer Review Type Date Requested Status
Henning Eggers (community) code Approve
Review via email: mp+22849@code.launchpad.net

Commit message

Remove bug page caching to nearly pointless levels, to avoid leaking private bug information in inline bug link tool tips

Description of the change

Remove bug page caching to nearly pointless levels, to avoid leaking private bug information in inline bug link tool tips.

If we want to speed up rendering of marked up text we should probably remove the tooltip functionality and turn the caching back up. That isn't my call though, so this just fixes the immediate security issue (which isn't live yet).

To post a comment you must log in.
Revision history for this message
Henning Eggers (henninge) wrote :

<stub> henninge: https://code.edge.launchpad.net/~stub/launchpad/memcache/+merge/22849
<stub> henninge: Security issue that needs to land before the edge update (about 55 mins?)
<wgrant> stub: The branch isn't in stable yet.
<wgrant> it's fine.
<henninge> stub: looking
<wgrant> (and probably won't be until some hours after edge updates tonight)
<henninge> stub: Shouldn't that comment be an XXX that links to a bug number where the issue is tracked?
<stub> Its not a bug though.
<stub> Actually, I just realized I need to turn off caching entirely to not lose functionality, as the tooltips will continue to display old summaries when bugs are changed.
<stub> I could put a lower timeout, but that is getting really pointless.
<henninge> stub: unfortunately I am not at all familiar with caching issues ...
<henninge> stub: but this still sounds like a quick fix to me that needs further investigation to find a proper solution and we should track that in a bug in order not to forget it.
<stub> I'm not sure what the bug is. Marked up test is uncachable due to Launchpad features. We either put up with it, or change Launchpad features. Its a discussion.
<stub> I've removed the cache: stanza entirely, so the diff is just a reversal of some work that landed an hour ago and an additional comment. I can remove the comment if you like, as I think it is throughout Launchpad rather than a bug comment specific issue.
* adeuring (~<email address hidden>) hat #launchpad-reviews betreten
<henninge> stub: ok, that sounds reasonable.
<stub> henninge: Reasonable enough for an approve vote?
<henninge> stub: certainly, I was waiting for the new push ... ;-)
<henninge> stub: r=me
<stub> Ta :)

review: Approve (code)

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'lib/lp/bugs/templates/bugcomment-box.pt'
2--- lib/lp/bugs/templates/bugcomment-box.pt 2010-03-29 12:29:37 +0000
3+++ lib/lp/bugs/templates/bugcomment-box.pt 2010-04-06 07:31:12 +0000
4@@ -74,16 +74,14 @@
5 </li>
6 </ul>
7
8- <tal:cache tal:replace="cache:authenticated,30 days,comment/index">
9- <div class="bug-comment"
10- tal:content="structure
11- comment/text_for_display/fmt:obfuscate-email/fmt:email-to-html">
12- Comment text.
13- </div>
14- <p tal:condition="comment/was_truncated">
15- <a tal:attributes="href comment/fmt:url">Read more...</a>
16- </p>
17- </tal:cache>
18+ <div class="bug-comment"
19+ tal:content="structure
20+ comment/text_for_display/fmt:obfuscate-email/fmt:email-to-html">
21+ Comment text.
22+ </div>
23+ <p tal:condition="comment/was_truncated">
24+ <a tal:attributes="href comment/fmt:url">Read more...</a>
25+ </p>
26 </div>
27 <div class="boardCommentFooter" tal:condition="comment/show_footer"
28 tal:content="cache:authenticated,30 minutes,comment/index">