search

stchang / pasterack

The Racket pastebin.
30 stars 7 forks source link

Added a restful API at "…/rest" (implements #48) #52

Closed SuzanneSoy closed 3 years ago

SuzanneSoy commented 8 years ago

The API accepts the same POST parameters as when using the main page, but doesn't require a continuation.

curl 'http://127.0.0.1:8000/rest' -H 'Content-Type: application/x-www-form-urlencoded' --data 'name=test&paste=%23lang+racket%0D%0A%28displayln+%27yay%29&fork-from=&g-recaptcha-response='

All the above parameters are mandatory, and the presence of the irc parameter implies the presence of the nick parameter:

curl 'http://127.0.0.1:8000/rest' -H 'Content-Type: application/x-www-form-urlencoded' --data 'name=test&paste=%23lang+racket%0D%0A%28displayln+%27yay%29&fork-from=&irc=&nick=georges-duperon&g-recaptcha-response='

I haven't tested this thoroughly as I don't have a propper redis setup. With the additionnal parameter checking, I don't see any added security concern, but please do double-check the security aspect before merging.

SuzanneSoy commented 8 years ago

This should implement the feature request #48

SuzanneSoy commented 8 years ago

This does not address how a user of the API would solve the captcha if needed. I think at the time the captcha was needed only when the "plain text" checkbox was unchecked, but now captchas are required for all operations.

stchang commented 7 years ago

For some reason, I missed this. Sorry! Will take a look today or tomorrow.

stchang commented 3 years ago

I just experimented with this a bit but couldnt figure out how to make it work with the captcha. It does make sense though since the two features are essentially trying to accomplish opposite things. (I made the captcha mandatory to try to control the spammers, who were getting out of control).

The right approach would probably involve some sort of authentication or secret key like what other sites do.

Closing for now, but really appreciate this.

(Send me a private msg if you still really need this feature and at worst we can come up with some adhoc solution)