Libarian: easily get a list of owners of an attachment.

[Paul Sladen]

Quite frequently, I find myself staring at an attachment (eg. patch) such as:

  http://librarian.launchpad.net/2989422/dvd-slideshow-debdiff

then I need to get back to the bug that originally lead me there. It would be handy if modifying the URL and deleting the filename:

  http://librarian.launchpad.net/2989422/

Gave me a link to any 'owners' of the attachment; eg. any item in Launchpad that links to it.

[Andrew Bennetts (spiv)]

We don't really want to make it easy to trawl the librarian by just incrementing a number in the URL.

The reverse lookup would also be moderately expensive with our current schema, although we can probably fix that if we really wanted.

But a cheap hack could solve this particular use case: malone could append "?frombug=NNNNN" to attachment URLs. Not particularly elegant, but pretty simple...

[Stuart Bishop (stub)]

Andrew Bennetts wrote:
> We don't really want to make it easy to trawl the librarian by just
> incrementing a number in the URL.
>
> The reverse lookup would also be moderately expensive with our current
> schema, although we can probably fix that if we really wanted.

Its not actually expensive - this has already been optimized to make the
librarian garbage collector work efficiently.

If there are issues with doing this, it would be security - I don't think
there are any issues with exposing this information (if attachment X comes
from bug y, then I don't see what is wrong with saying that as bug y will be
private if it contains sensitive information). However, it might provide
enough information to make other attacks possible (eg. it gets you half way
to accessing attachments of private bugs). We need to think about it before
implementing anything.

> But a cheap hack could solve this particular use case: malone could
> append "?frombug=NNNNN" to attachment URLs. Not particularly elegant,
> but pretty simple...

--
Stuart Bishop <email address hidden> http://www.canonical.com/
Canonical Ltd. http://www.ubuntu.com/