4 ms·
How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authe
by beambot 13y ago
How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.
- joshfraser 13y agoIf I recall correctly the code looked something like this: <?php if (!admin()) echo "<script>window.location = '/signin';</script>"; delete_bid($_GET['bid_id']); ?>
- mbenjaminsmith 13y agoWhen you think about it it's actually pretty elegant -- if your purpose is to write something that appears to work but will do the worst possible thing when crawled.
- sigkill 13y agoSomething like the underhanded C contest then?
- xerophtye 13y agoa simple 'else' would have at least stopped the deleting part :/
- bdg 13y agoThis could have been written in the mindset that JavaScript and PHP ran at the same time. Lots of people still believe that.
- StavrosK 13y agoI don't understand. Was it supposed to delete the thing anyway, and then redirect if the user wasn't an admin?