Putting a Follow a User Link in Descriptions, etc Disabled

It appears they have found a solution…

Sneek said
It appears they have found a solution… http://imageshack.us/f/341/screenshot20120109at093.png/

But when You click ok – You end up on blank page…

It would be nice if we have these important changes in our Dashboard, so noone miss it…

quickandeasy said
any chance you can redirect the url to take you to the users profile? Just so all those links that are now spread around the site can be utilized

+1

Bad news I need to change about 85 descriptions….
Any chance to redirect the users to the profile page like was said?

I don’t see how can anybody mislead somebody to follow them when there is pop-up message/alert (like shown on Sneek’s screenshot)??? I don’t get it…

urbazon said
I don’t see how can anybody mislead somebody to follow them when there is pop-up message/alert (like shown on Sneek’s screenshot)??? I don’t get it…

You’re not a coding dude I guess

A good solution would be to do this:

if the POST variable authenticity_token is sent, continue as normal, otherwise:

load a webpage with some text which says “You are about to follow this user on the marketplaces, do you want to continue?” and display a form with its method as POST and target as the current page and a hidden input authenticity_token. and another one with something like display_page = true. (currently when authenticity_token is undefined it returns a blank page with a 404 header)

Then when the url is visited, and authenticity_token sent AND display_page is also sent via POST variables, instead of returning JSON data, it will return a page with a confirmation message.

sorted. All the old links work and there are no security holes!

I am right in thinking the url which was disabled is: marketplace.net/user/someone/follow right?

D’oh

Too bad for the people who have to change ALL the descriptions of their items. But devs, I’m sure you are that cool to find a solution to this instead of disabling it! right?

Reaper-Media said
A good solution would be to do this:

if the POST variable authenticity_token is sent, continue as normal, otherwise:

load a webpage with some text which says “You are about to follow this user on the marketplaces, do you want to continue?” and display a form with its method as POST and target as the current page and a hidden input authenticity_token. and another one with something like display_page = true. (currently when authenticity_token is undefined it returns a blank page with a 404 header)

Then when the url is visited, and authenticity_token sent AND display_page is also sent via POST variables, instead of returning JSON data, it will return a page with a confirmation message.

sorted. All the old links work and there are no security holes!

I am right in thinking the url which was disabled is: marketplace.net/user/someone/follow right?

+1

Either that or Adam’s idea (redirect to profile) in the short term at least, otherwise we’re going to have a lot of confused customers and authors.

I certainly understand the need to plug the security hole. It’s really too bad when a few immoral authors ruin things for everyone

Sneek said
It appears they have found a solution… http://imageshack.us/f/341/screenshot20120109at093.png/

Wasn’t this there for some time?