Subject: [TOOLS-DEVELOPMENT] Tool List Rewrite Feedback

From: Ray Pelletier <[email-masked]>
Date: Sat, 28 Apr 2007 14:50:29 -0400

Michael,

Below is the feedback from Henrik and Bill regarding the tools list that 
was suggested for a Python rewrite.
You should use it to compile a final Python rewrite tool list and to 
develop the proposal. 

For the avoidance of doubt you should reply with a clean final Python 
rewrite tool list.

Ray
---------------------------------------------------------

 >Of those tools below, following tools are subject to be re-written 
 >> because they are taking some kind of input from outside users (IESG, 
 >> WG chairs, Liaison Managers, and other public users.)
 >>
 >> * Library:
 >>   - IETF.pm
 >>   - GEN_DBUTIL_NEW.pm
 >>   - GEN_UTIL.pm

If the interfaces (.cgi files listed below) are re-written,
the module files above may be irrelevant.

 >> * I-D Tracker:
 >>   - idtracker.cgi

ack

 >>   - display_news.cgi

Is this public?

 >>   - pidtracker.cgi

ack

 >> * IETF Announcement Sender:
 >>   - ietf_announcement.cgi

--
Right, as far as I know this is a secretariat tool so can be done
in phase 3 if at all.
--

Is this publicly available?  I don't think it should be.  Doesn't
seem like it should be on the primary list if not.  And what about

    previous_announcement.cgi
    recent_announcement.cgi
    rfc_editor_announcement.cgi
--
Since they take no user input in creating the sql, perhaps
Michael thought they could be skipped, but they're vulnerable to
the shell/perl injection.
--

 >> * IPR Tool:
 >>   - ipr.cgi
 >>   - ipr_detail.cgi
 >>   - ipr_detail_show.cgi
 >>   - ipr_generic.cgi
 >>   - ipr_list.cgi
 >>   - ipr_notify.cgi
 >>   - ipr_update_list.cgi
 >>   - upload.cgi

All of these, yes.

 >> * Liaison Tool:
 >>   - liaison_mananger.cgi
 >>   - liaison_detail.cgi

Yes, and more:

    area_mailing_list.cgi
    liaison_field_help.cgi
    liaison_guide_from_ietf.cgi
    liaison_guide_to_ietf.cgi
    liaison_managers_list.cgi
    liaisons.cgi

 >> * Mailing List Request Tool:
 >>   - request_approve_mail.cgi
 >>   - request_area_confirm.cgi
 >>   - request_confirm.cgi
 >>   - request_list.cgi
 >>   - request_mail.cgi

Yes

 >> * Non-WG mailing list posting tool:
 >>   - nwg_list_approve.cgi
 >>   - nwg_list_submit.cgi

Yes

 >> * WG chairs tools:
 >>   - password_manager.cgi
 >>   - session_approval.cgi
 >>   - wg_proceedings.cgi
 >>   - wg_session_requester.cgi

These are password-protected, I think?  For later re-write, but
not for immediate replacement if protected.

 >> * I-D Database Interface:
 >>   - idindex.cgi

Yes.

Looking at the tarball received earlier, at least the following
which are listed under public tools should be rewritten or removed:

all_id.cgi             meeting_agenda_text.cgi
all_id_html.cgi             meeting_materials.cgi
area_mailing_list.cgi         nwg_list.cgi
idindex.cgi             nwg_list_submit.cgi
ipr.cgi                 pidtracker.cgi
ipr_detail.cgi             previous_announcement.cgi
ipr_detail_show.cgi         recent_announcement.cgi
ipr_disclosure.cgi         request_approve_mail.cgi
ipr_generic.cgi             request_area_confirm.cgi
ipr_list.cgi             request_confirm.cgi
ipr_notify.cgi             request_list.cgi
ipr_search.cgi             request_mail.cgi
ipr_update_list.cgi         rfc_editor_announcement.cgi
lastcall.cgi             show_nomcom_message.cgi
liaison_detail.cgi         states_table.cgi
liaison_field_help.cgi         status_of_item.cgi
liaison_guide_from_ietf.cgi  upload.cgi
liaison_guide_to_ietf.cgi    view_meeting_agenda_html.cgi
liaison_managers_list.cgi    view_meeting_agenda_text.cgi
liaisons.cgi             view_telechat_minute.cgi
meeting_agenda_html.cgi

--

I think a fair number can be removed, since I think they were
changed from cgi generation to cron generation to a file - e.g.,
the all_id ones, last call, status of items, probably others.
--

_______________________________________________
TOOLS-DEVELOPMENT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-development

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 30 Apr 2007 10:01:50 +0200

>>> * IETF Announcement Sender:

Actually this one is externally available to (at least) Russ, but
protected by login/https. I don't know if we consider that enough.

I just checked. My access has been removed, and the script replies:

"This tool has not been ready for you to use yet. (43)"

     Brian