Repository navigation
docs(15.10): correct the login rate limit, log file API and status code descriptions of the API pages - #609
Merged
Merged
Conversation
…de descriptions of the API pages Update the 15.10 development tree in all seven languages. - api-auth: the login form (POST /login/login) shares the rate-limit buckets and the lockout with POST /api/v2/auth/login; a successful login clears the failures of that address and user pair but only gives back the one address slot it consumed; behind a proxy that is not listed in rate.limit.trusted.proxies all clients share one address. - api-admin-log: an unknown or disallowed log file name, or an id that is not Base64, answers a validation error (HTTP 400, status 1) instead of an empty response; ids are URL-safe Base64. - api-admin-storage: GET /api/admin/storage/list answers HTTP 400 when no storage client plugin is installed. - api-admin-dict: output of a mapping entry is required. - upgrade: add the log file, mapping output, storage listing and login form rows to the table of requests the API now refuses, and list the changes to the webauth/fileauth password, the user code of a logged-in user, "delete all" roles, role values without a cipher, unknown request charsets and dictionary failure messages. - user API pages: add the 400, 403 and 503 status codes that openapi-user.yaml declares and the tables lacked (the chat page is not changed).
…it in the upgrade guide Behind a reverse proxy that is not listed in rate.limit.trusted.proxies, all clients share one login rate-limit bucket. Say so in the upgrade table row for the login form limit, in all seven languages.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Corrects stale descriptions in the 15.10 (development) API documentation, in ja, en, de, es, fr, ko and zh-cn. Every statement was checked against the Fess source at the 15.10 development head.
api/api-auth.rst): the form loginPOST /login/loginuses the same buckets, limits and lockout asPOST /api/v2/auth/login(theme.api.login.*). A successful login clears the earlier failures of the same address and user pair, but the per-address bucket is not cleared (only the slot the attempt consumed is given back). Added a note that behind a reverse proxy not listed inrate.limit.trusted.proxies(default127.0.0.1,::1) all clients share one address, so failed logins can lock everyone out for the lockout period.api/admin/api-admin-log.rst): an unknown or disallowed file name, or a malformed id, answers a validation error (HTTP 400,status1) instead of an empty response. Ids are URL-safe Base64; standard-alphabet ids are still accepted.api/admin/api-admin-storage.rst):GET /api/admin/storage/listanswers HTTP 400 naming the plugin to install when no storage client plugin is present.api/admin/api-admin-dict.rst):outputof amappingentry is required.install/upgrade.rst): new rows in the table of requests the API now refuses (log file name,mappingwithoutoutput, storage listing failure, form login rate limit) and a list of related behaviour changes (webauth/fileauth password, user code of a logged-in user, "delete all" needs the edit role, role parameter/header/cookie ignored without a cipher, unknown request charset, dictionary failure messages).api/api-*.rst): added the 400, 403 and 503 codes thatopenapi-user.yamldeclares but the tables lacked (503 on the endpoints that use the search engine; 400 for undecodable request parameters on label, health, related, ui-config and the auth endpoints; 403 on login). Codes the spec does not declare were left in place. The chat page is not changed.config/properties.rstis generated fromfess_config.properties, so it is not edited here.Test plan