resolution_duplicate type_defect | by mt@lowentropy.net
The current form submission process allows people to submit drafts for others. It just adds the following warning:
"Please note that since the database does not have your email address in the list of authors of previous revisions of the document, you are not receiving a confirmation email yourself; one of the addressees above will have to send a confirmation in order to complete the submission. This is done to avoid document hijacking. If none of the known previous authors will be able to confirm the submission, please contact the Secretariat for action."
The QUIC working group has a repository with multiple drafts. Synchronizing publication of those drafts is desirable, so a single person does this. The automated submission API rejects these uploads with a message such as:
"Validation Error: [u'Submitter martin.thomson@gmail.com is not one of the document authors']"
Now the email address isn't authenticated at this step, so it would be possible to spoof the email address of a legitimate author, but that is difficult and unnecessary. I would rather have the system allow the draft to be submitted.
I know that this might not be exactly what we discussed; we agreed that the submitter would be an author AND have an account, but it turns out that the author requirement is a real burden in practice.
Issue migrated from trac:2390 at 2022-03-04 05:59:00 +0000
resolution_duplicatetype_defect| by mt@lowentropy.netThe current form submission process allows people to submit drafts for others. It just adds the following warning:
"Please note that since the database does not have your email address in the list of authors of previous revisions of the document, you are not receiving a confirmation email yourself; one of the addressees above will have to send a confirmation in order to complete the submission. This is done to avoid document hijacking. If none of the known previous authors will be able to confirm the submission, please contact the Secretariat for action."
The QUIC working group has a repository with multiple drafts. Synchronizing publication of those drafts is desirable, so a single person does this. The automated submission API rejects these uploads with a message such as:
"Validation Error: [u'Submitter martin.thomson@gmail.com is not one of the document authors']"
Now the email address isn't authenticated at this step, so it would be possible to spoof the email address of a legitimate author, but that is difficult and unnecessary. I would rather have the system allow the draft to be submitted.
I know that this might not be exactly what we discussed; we agreed that the submitter would be an author AND have an account, but it turns out that the author requirement is a real burden in practice.
Issue migrated from trac:2390 at 2022-03-04 05:59:00 +0000