4 ms·
It's just an adaptation of the old, non-js html, in which the arrows were just links, and it's written such that it will work in the old way if the js doesn't w
by paul 19y ago
It's just an adaptation of the old, non-js html, in which the arrows were just links, and it's written such that it will work in the old way if the js doesn't work for some reason (like I never bothered to test it with all the browsers).
Anything that assumes that GET links can be arbitrarily followed will break stuff all over the web. GWA needs all kinds of heuristics to avoid that kind of thing. (maybe they avoid sending cookies or session ids?)
- palish 19y agoExcept it's vulnerable to an iframe exploit. See: http://news.ycombinator.com/item?id=27615 http://news.ycombinator.com/item?id=27615
- paul 19y agoFalse (that GET causes the problem), see http://news.ycombinator.com/item?id=27629 http://news.ycombinator.com/item?id=27629
- Bogtha 19y ago> Anything that assumes that GET links can be arbitrarily followed will break stuff all over the web. Arbitrarily performing GETs is something condoned by the HTTP 1.1 specification. Anything that assumes that GETs won't be arbitrarily followed is clueless. You'd think people would have learned this the first time around. Don't write out-of-spec code and then complain when conforming code comes along and trashes your app. It's your bug, not theirs. > GWA needs all kinds of heuristics to avoid that kind of thing. How reliable. Wouldn't it be better to follow the spec so this kind of guesswork wasn't necessary?