google spreadsheets are publicly editable

[mireille-raad]

The spreadsheets seem to be open for editing by anyone. I clicked "view spreadsheet" - edited it to do some of the required changes... and they were reflected automatically.

We should probably consider securing those and keeping collaborators only. no?

[Uav-development]

Hi, the original specification was for the site to be publicly editable. That is also why the site was requested to be built on GitHub. The team managing it going forward can of course decide to change the permissions.

• Mita @ BrightFront

On May 24, 2017, at 5:46 PM, Mireille Raad notifications@github.com wrote:

The spreadsheets seem to be open for editing by anyone. I clicked "view spreadsheet" - edited it to do some of the required changes... and they were reflected automatically.

We should probably consider securing those and keeping collaborators only. no?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[mireille-raad]

hmm thanks... will figure it out with trevor... thanks for clarification :)

[mireille-raad]

I looked into this a little bit further, here is what I tried:

• I stopped publishing the changes to the spreadsheet automatically... I tried to have a workflow where data is published only after review... but it turned out this is not an admin only feature, anyone can do this.
• I tried to have the share setting as view only + comments
• I tried to see if there is a "suggestion" mode for spreadsheets
• I looked into some plugins and addons for google docs

I discovered that

• anyone can decide to un-publish the documents, you don't need to be the creator ( I was never added to the sheets, I just access them publicly)

• anyone can decide to change the permissions for the sheets, meaning we won't be able to access them.

• there is really no workflow for controlling content

Screenshots below

I was able to un-publish the spreadsheets, here is how the site looked like

I could change the security settings of sheets and kick ppl out, i didn't click yes

I looked into a few options of how to do this and here is the proposed workflow:

• host the csv files on github.
• create a form where people can submit data - here is example https://goo.gl/forms/m3whfXgJeTpBKyZg1
• everytime someone submits form, we will receive email notification...we'll research the suggestion and if correct, we can update github directly with the new data. Since the files are small, we may be able to do those edits from the UI in github, meaning anyone, not just a dev can do this (we'll need to add the .csv to .gitignore)
• on the webpage, i'll add a script that reads the csvs and renders them in a well designed html table (not embed code)
• it is better to host the files as csv on github and not private spreadsheets on google because then we don't have to guess the accounts of who can access the sheets... we also have less things to manage, our content will be only on github.

@pythagoraswitch does this sound ok?

[pythagoraswitch]

Hosting csv on GitHub makes sense! It's scary for many reasons to host the tables on google spreadsheet with all permissions public, as you pointed out. While we want to encourage people to directly make PR using GitHub UI, it is certainly great to have the form for non-techies. We can work on the questionnaire -- it would be good ask their credibility (where did you get this information? 1) I work for the company 2) I am a UAV enthusiast, etc..) with their name & email address, for example.

Thank you for working on this problem!

[mireille-raad]

I just added you to the google form questionnaire, please feel free to edit it, add introductions, change colors and design etc.

I transferred ownership of form to you since you work more on this project on the long run. I am still a collaborator.