non-conformance with RFC 2616, HTTP/1.1 for object_cut, object_delete

[vinsci]

Currently (sine 2.1), the object_delete script provide item deletion with access through a HTTP GET request. RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1) however, in section 9.1.1 Safe Methods, states: "... In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. ...".

While deletion of an item through the actions menu is guarded with a javascript alert, a user can be tricked into clicking on a malicious link elsewhere that will carry out the deletion without confirmation. The action is still carried out through a HTTP GET request rather than a HTTP POST.

(From HTML, there's no way to ask for a HTTP DELETE request to be sent)

[alecm]

Seems reasonable, make a patch and a functional test it will be gladly accepted.

[limi]

This is actually quite important to get fixed, deletion should never be possible via GET requests. Anybody want to step up for this?

[vinsci]

Some initial legwork for fixing this:

Original changeset where this was introduced: http://dev.plone.org/plone/changeset/6524

Changes to object_delete.cpy & .metadata, since introduction:

http://dev.plone.org/plone/log/CMFPlone/trunk/skins/plone_scripts/object_delete.cpy?action=follow_copy&rev=9836&stop_rev=&mode=follow_copy&verbose=on

http://dev.plone.org/plone/log/CMFPlone/trunk/skins/plone_scripts/object_copy.cpy.metadata?action=follow_copy&rev=9836&stop_rev=&mode=follow_copy&verbose=on

Changes to object_cut.cpy & .metadata, since introduction:

http://dev.plone.org/plone/log/CMFPlone/trunk/skins/plone_scripts/object_cut.cpy?action=stop_on_copy&rev=9836&stop_rev=&mode=follow_copy&verbose=on

http://dev.plone.org/plone/log/CMFPlone/trunk/skins/plone_scripts/object_cut.cpy.metadata?action=follow_copy&rev=9836&stop_rev=&mode=follow_copy&verbose=on

[alecm]

Cut/copy actions take no actions which affect the ZODB, I think it is the paste action that we really have to worry about here. In particular we can add a confirmation form for paste, similar to the one I am about to do for delete.

[alecm]

Making note to add paste confirm form.

[wichert]

Has this been fixed as part of the recent postonly work?

[wichert]

Assuming it has, so closing the ticket.

[mj]

This is still on my TODO pile to look at; will reopen if the postonly fixes don't cover this.