Tutorial skips over a race condition
|Reported by:||donald.ball@…||Owned by:||nobody|
|Has patch:||no||Needs documentation:||no|
|Needs tests:||no||Patch needs improvement:||no|
In the portion of the tutorial where you introduce the template system, you don't make any mention of how to escape output to avoid XSS and similar attacks. Later, when you show code to increment the vote count, you have a classic race condition.
Both of these potential bugs could be considered advanced topics, not suitable for an introductory tutorial, but I am of the view that you should show folks the correct way to do things from the get-to.
Change History (6)
comment:1 follow-up: ↓ 2 Changed 6 years ago by anonymous
- Needs documentation unset
- Needs tests unset
- Patch needs improvement unset
comment:5 Changed 6 years ago by Simon Greenhill
- Summary changed from Tutorial skips over two bugs: output escaping and a race condition to Tutorial skips over a race condition
- Triage Stage changed from Unreviewed to Accepted
- Version changed from 0.96 to SVN