We show all users on the system, which is probably not good

[wasade]

Discovered when using lynx on qiita.microbio.me. If you navigate to view my studies, you see a list of all users that have accounts on qiita. Not sure why, seems... not good.

[antgonza]

My guess is that JS/jquery is not working well and is showing all the emails (not all info) as it is used for the display of studies. Not sure if there is a work around this.

[squirrelo]

This is a byproduct of the sharing code autocomplete feature. Do we want to remove the autocomplete and instead have them type in the full email, then give a yes/no indication on the user existing and sharing working?

[wasade]

I think its low prio right now, but websockets?
On Apr 24, 2015 6:31 PM, "Joshua Shorenstein" notifications@github.com
wrote:

This is a byproduct of the sharing code autocomplete feature. Do we want
to remove the autocomplete and instead have them type in the full email,
then give a yes/no indication on the user existing and sharing working?

—
Reply to this email directly or view it on GitHub
#1092 (comment).

[wasade]

What method does google use when typing in a search bar?
On Apr 24, 2015 6:36 PM, "Daniel T. McDonald" Daniel.Mcdonald@colorado.edu
wrote:

I think its low prio right now, but websockets?
On Apr 24, 2015 6:31 PM, "Joshua Shorenstein" notifications@github.com
wrote:

This is a byproduct of the sharing code autocomplete feature. Do we want
to remove the autocomplete and instead have them type in the full email,
then give a yes/no indication on the user existing and sharing working?

—
Reply to this email directly or view it on GitHub
#1092 (comment).

[squirrelo]

I don't know, but we apparently may be able to ajax this:
https://rvieiraweb.wordpress.com/2013/04/20/jquery-ajax-chosen-simple-demo-tutorial/

On Fri, Apr 24, 2015 at 5:37 PM, Daniel McDonald notifications@github.com
wrote:

What method does google use when typing in a search bar?
On Apr 24, 2015 6:36 PM, "Daniel T. McDonald" <
Daniel.Mcdonald@colorado.edu>
wrote:

I think its low prio right now, but websockets?
On Apr 24, 2015 6:31 PM, "Joshua Shorenstein" notifications@github.com
wrote:

This is a byproduct of the sharing code autocomplete feature. Do we want
to remove the autocomplete and instead have them type in the full email,
then give a yes/no indication on the user existing and sharing working?

—
Reply to this email directly or view it on GitHub
#1092 (comment).

—
Reply to this email directly or view it on GitHub
#1092 (comment).

[josenavas]

This is going to be slow unless we cache those values at some place, so we don't have to go to the database that many times.

[ElDeveloper]

Redis to the rescue :D!

On (Apr-24-15|17:47), josenavas wrote:

This is going to be slow unless we cache those values at some place, so we don't have to go to the database that many times.

---

Reply to this email directly or view it on GitHub:
#1092 (comment)

[squirrelo]

While looking into #1730 I realized this is still open. I want to close this as part of the share changes, but there is one sticking point: Do we want to keep the autocomplete functionality at all? It looks to me like it would be just as not good, since someone could easily type 'a', get all emails, then 'b', get all emails, etc and quickly have the emails of everyone on the system.

The safer way is to have a text box for entering a user email that, when you hit share, says 'successful' or 'user does not exist' depending on the outcome. This removes the security concern completely, and presumably you would have the email of your collaborator you are sharing a study with.

There are ways to make redis autocomplete happen (http://stackoverflow.com/a/24425711 and https://www.devbridge.com/sourcery/components/jquery-autocomplete/#) but I would like people's input before going that route.

[ackermag]

Not sure why we would hide users.
On Apr 6, 2016 4:43 PM, "Joshua Shorenstein" notifications@github.com
wrote:

While looking into #1730 #1730 I
realized this is still open. I want to close this as part of the share
changes, but there is one sticking point: Do we want to keep the
autocomplete functionality at all? It looks to me like it would be just as
not good, since someone could easily type 'a', get all emails, then 'b',
get all emails, etc and quickly have the emails of everyone on the system.

The safer way is to have a text box for entering a user email that, when
you hit share, says 'successful' or 'user does not exist' depending on the
outcome. This removes the security concern completely, and presumably you
would have the email of your collaborator you are sharing a study with.

There are ways to make redis autocomplete happen (
http://stackoverflow.com/a/24425711 and
https://www.devbridge.com/sourcery/components/jquery-autocomplete/#) but
I would like people's input before going that route.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#1092 (comment)

[squirrelo]

The major concern is that anyone with an account on the system would be able to access everyone else’s email address, opening users up to spamming.

On Apr 6, 2016, at 16:51, Gail Ackermann notifications@github.com wrote:

Not sure why we would hide users.
On Apr 6, 2016 4:43 PM, "Joshua Shorenstein" notifications@github.com
wrote:

While looking into #1730 #1730 I
realized this is still open. I want to close this as part of the share
changes, but there is one sticking point: Do we want to keep the
autocomplete functionality at all? It looks to me like it would be just as
not good, since someone could easily type 'a', get all emails, then 'b',
get all emails, etc and quickly have the emails of everyone on the system.

The safer way is to have a text box for entering a user email that, when
you hit share, says 'successful' or 'user does not exist' depending on the
outcome. This removes the security concern completely, and presumably you
would have the email of your collaborator you are sharing a study with.

There are ways to make redis autocomplete happen (
http://stackoverflow.com/a/24425711 and
https://www.devbridge.com/sourcery/components/jquery-autocomplete/#) but
I would like people's input before going that route.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#1092 (comment)

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub #1092 (comment)

[rob-knight]

This seems like a theoretical rather than practical concern surely?

On Apr 6, 2016, at 4:53 PM, Joshua Shorenstein notifications@github.com wrote:

The major concern is that anyone with an account on the system would be able to access everyone else’s email address, opening users up to spamming.

On Apr 6, 2016, at 16:51, Gail Ackermann notifications@github.com wrote:

Not sure why we would hide users.
On Apr 6, 2016 4:43 PM, "Joshua Shorenstein" notifications@github.com
wrote:

While looking into #1730 #1730 I
realized this is still open. I want to close this as part of the share
changes, but there is one sticking point: Do we want to keep the
autocomplete functionality at all? It looks to me like it would be just as
not good, since someone could easily type 'a', get all emails, then 'b',
get all emails, etc and quickly have the emails of everyone on the system.

The safer way is to have a text box for entering a user email that, when
you hit share, says 'successful' or 'user does not exist' depending on the
outcome. This removes the security concern completely, and presumably you
would have the email of your collaborator you are sharing a study with.

There are ways to make redis autocomplete happen (
http://stackoverflow.com/a/24425711 and
https://www.devbridge.com/sourcery/components/jquery-autocomplete/#) but
I would like people's input before going that route.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#1092 (comment)

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub #1092 (comment)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub #1092 (comment)