Suggestions for bulk upload by users

Summary:

Using the API requires a key... regular users don't have one.

Suggestions for bulk upload by users

Steven Heynderickx 26 Jan 2011 10:01

After building some tool that uses the API, you still face the problem that a user needs to provide his key to use the Application. For administrators and developers this is no problem, they know the ins and outs of the system (or they should know them). To allow regular users to use an API-App that's something different!

If I build an App it is to read or write data to the site. I have no problem with the fact that users can read data using my App… That would be silly because otherwise I should not have made the App.

It is however different with writing to the site, deleting or modifying. I do NOT wish that a user can modify or delete pages by accident. So I understand the caution here!

But I would allow my users to CREATE pages as much as they want. They can always be removed afterwards.

SO if I would make an API-App for users that allows them to create pages… I have no fear. There is no damage that can be done (maybe overload on the server). But in this case all my users need an API-key. Which is impossible. So far there is no problem because my API-App can use my API-key. BUT then I will be the creator of the pages WHICH is not true.

SO I suggest that the page.save_one has an extra value or some way to save the true creator (%%current.memebr%%) of the page (not the API-key-owner!)

I know that this may sound confusing so please feel free to ask questions.

---

A - S I M P L E - P L A N by ARTiZEN a startingpoint for simple wikidot solutions.

Re: Suggestions for bulk upload by users

soronlin 26 Jan 2011 11:20

But then anyone would be able to masquerade as anyone else.

As I understand Wikidot policy, the creator ID and creation time will never be compromised… However much we may beg.

I believe that the original API roadmap was for the key to correspond to the application. That means every user with a application can make changes to the same sites. That is obviously wrong. How it is at the moment forces end-users to get a key. That is probably how it needs to be. But there needs to be a relatively easy way for applications to download the current user's key. I believe the future plan is that every user has a key, or can request one from within their user-profile pages.

It would be useful if we could piggy-back on an existing browser login to fetch the current user's key, but I don't know how to do that. It is obviously not a good idea to expose applications to a user's username and password.

Maybe a Javascript page could be written that downloaded the current user's key to a well-known location on the local PC. However that is a security hole if the user happens to be in an Internet cafe.

Re: Suggestions for bulk upload by users

Steven Heynderickx 26 Jan 2011 13:11

"But then anyone would be able to masquerade as anyone else."
Well I would only allow this to the Master Administrator… But I see the possible abuse also there…

---

A - S I M P L E - P L A N by ARTiZEN a startingpoint for simple wikidot solutions.

Re: Suggestions for bulk upload by users

Steven Heynderickx 26 Jan 2011 13:25

Other possible solution to this/my problem:

I use PHP to run a API-request. To do this I create external links to my server that runs the API-Applications. Maybe wikidot could create a new kind of link syntax that would allow something like this.

What we need is a trigger for the API to start and a ticket for the user that started the API-App.

Wikidot has build a module listuser… that generates the number and name of the user.
So an API link has this build inside to link the ticket to the user.

Together with the URL you wish the link should go to.

So imagen [[[:API:link-url | linktext]]]

• tripple [[[ because it is an internal link
• :API: will always go to a wikidot-systempage that will add some flag-key (ticket) to the requested link-url.
• the API-App will recieve this information and can act using the flag-key (ticket)
• if the flag-key (ticket) returnes to the API-server of wikidot the userkey can be switched to the correct user (=not the API-developer).

In this scenario the developer never owned the key of the user… so no abuse is possible.

---

A - S I M P L E - P L A N by ARTiZEN a startingpoint for simple wikidot solutions.

Last edited on 26 Jan 2011 13:32 by Steven Heynderickx Show more

Re: Suggestions for bulk upload by users

Gabrys 26 Jan 2011 16:07

I don't see what's the original problem anyway. Whenever you try to solve problems that are not well defined, more specific problems arise, that are even more problematic than the original (the undefined) one.

If you could say what's your (original) problem, I guess we could all help you.

---

Piotr Gabryjeluk
visit my blog

Re: Suggestions for bulk upload by users

Steven Heynderickx 26 Jan 2011 22:33

Sorry Piotr but this is a forum. If something is not clear to you ask for more info, don't start sugesting that my problem is a stupid one or that the possible solution is a stupid solution. I don't like the way you 'write' to me. I think I deserve a bit more respect than this.

"What's the (original) problem anyway?…"

It is well stated: An API-Application can only be used by the creator of the application if you want to maintain ownership of pages created by that API-application. An API-application uses the API-key provided to it and since the key is private it is impossible for other users to use an API-application without giving out their key (IF they have one).

Rurwin immediatly knew what I was talking about, maybe you need to do a bit more effort to put yourself in the position of the person who was writing, instead of shooting your guns. Think before you speak or ask intelligent questions.

I know this is not the a good way to react because… you are the developer, the guru, the wikidot-god and we are just simple users, but I think that I have the right to protest in this case. I am offended by your comment and I want you to know this. That is no way of creating a positive collaborative work environment.

I have no comments on any other skills than your writing skills. That is the only thing I want to say. I hope this does not interfere with our working relation but you need to know that you can not bark at people like that and expect them to keep quite.

---

A - S I M P L E - P L A N by ARTiZEN a startingpoint for simple wikidot solutions.

Re: Suggestions for bulk upload by users

tsangk 27 Jan 2011 04:20

The API was never designed for the developer to integrate his/her own key into the application. It was designed for the user to provide his/her own key to work with the program. Later on, API keys will be automatically generated by Wikidot and all users will have a key to use for programs.

---

Kenneth Tsang (@jxeeno)

Re: Suggestions for bulk upload by users

soronlin 26 Jan 2011 23:37

Consider the case where end-user "User" pops up, asks how to do something and gets directed to an API application written by "Author".

There are two cases:

1. Either the application will use Author's API key, and all created pages will be authored by him,
2. Or User has to do some nasty cut-and-paste in order to insert his API key.

The moment an application gets access to an API key then there is the possibility that it might do something naughty with it. The situation is more dangerous if the application gets User's username and password.

Assuming we need to keep the API key methodology, if we are to make User's life easier, then we need a browser-based method of fetching the current user's API key and supplying it to either a web-hosted application, or a local application. It must be browser-based because the browser is the entity with the authorisation cookies.

in addition it would be risky to distribute an application that used Author's API key, because that key could be used to deface his sites.

Re: Suggestions for bulk upload by users

tsangk 27 Jan 2011 04:23

I agree - there should be an easier way for users to obtain their API keys. And as I pointed out in my previous post - I don't think Wikidot ever designed the API to work with the developer's key hardcoded.

---

Kenneth Tsang (@jxeeno)

Re: Suggestions for bulk upload by users

soronlin 27 Jan 2011 12:29

There are cases where a hard-coded key would be useful. For example a smart-phone application that used a Wikidot site as a back-end database.

The best way to handle this at present is for the developer to create a new Wikidot account that had limited permissions, but I don't think Wikidot has ever officially stated where they stand on users having multiple accounts. In the case of a smart-phone application, that account would be used by many other people, and I think this would break the Wikidot Terms of Service.

Other prohibited usage includes:
…
9. using an identity (account, username, password) of another User or disclosing your own username or password to any third party or permitting any third party to access your account;

Re: Suggestions for bulk upload by users

leiger 27 Jan 2011 06:21

I don't see what's the original problem anyway. Whenever you try to solve problems that are not well defined, more specific problems arise, that are even more problematic than the original (the undefined) one.

If you could say what's your (original) problem, I guess we could all help you.

@Gabrys:

I found the first post confusing to read as well. As I have been talking to Steven about this before though, I'm fairly certain I know what he is requesting:

• The ability to use the Master Administrator's API key to define which user should be set as creator of a new page.

Unfortunately, as it's been stated here as well, I don't think this will ever be granted. And… I think that the aim should probably be on making it EASY for users to get their API key instead.

1. There shouldn't be a need to request it on this site first - all users need a way to access an API key easily. As far as I know this is planned, but not yet available/implemented.
2. We need a direct URL to the page that displays the user's API key. That way, we can open this URL directly and make it easy for the user to copy and paste it into the application, rather than trying to find it at the bottom of the account settings page. (if the user is logged out, they should be able to log in using this URL and immediately be shown their API key afterwards)

I'd also like to see a way to create a Wikidot account using the API - or at least, a page on Wikidot.com that is specifically designed for client applications (e.g. a message to "close this window and return to the application" at the end of the registration process) — however, I'm willing to accept that Wikidot may reject this as well.

I shouldn't even be posting here… am meant to be on holiday ;-)

---

~ Leiger - Wikidot Community Admin - Volunteer
Wikidot: Official Documentation | Wikidot Discord server | NEW: Wikiroo, backup tool (in development)

Last edited on 27 Jan 2011 06:23 by leiger Show more

Re: Suggestions for bulk upload by users

Gabrys 28 Jan 2011 16:52

OK, I see where this is going. The problem here is having web-based applications integrated with Wikidot experience. Similarly to how you can log-in to sites using your Facebok account, or use various Twitter applications (like the Wikidot's one: Tweet My Wiki).

The original way in which API works is there's an (non-web) application that uses some kind of authentication (API key or user/password pair) to do stuff in user's name. This is what Wikidot supports right now.

The "Web 2.0" way is there's web (or desktop) application that asks users to "authorize" the application by pointing them to a special page, on which they can log-in (unless already logged-in) and authorize (or deny) the application. If you want to see how it works live check this blog post (ideally repeating the steps yourself).

As recently we've been playing with Twitter as the client-side of the whole process and we're quite familiar in how it works. Twitter uses OAuth protocol for authentication and probably we'll once implement it too, as there's no point in inventing a new protocol when this works.

Till that time, we'll stick to the old API key method. Answering some of the questions and suggestions above, I would like to say that:

• users won't need to apply for the API keys
• each user will have two API keys: one read-only, one read-write
• we'll assign an URL at which users can see their keys (so that apps can ask them to go there)
• we're not going to allow anyone post as someone else or sometime else (changing page authors or dates of events after they happen)
• we're not going to let users create or modify their accounts or create sites via the API. API will be the way to modify the site contents once the site exists. Site and user creation must be done in-browser. Otherwise we get spammed heavily and we need to shut down the service.

Sorry for being offensive before, I wasn't going to. I just wanted to point that usually it's better to share the original problem instead of asking how to solve all problems that appear after you try to solve the original problem yourself.

---

Piotr Gabryjeluk
visit my blog

Re: Suggestions for bulk upload by users

Steven Heynderickx 28 Jan 2011 16:58

Apology accepted.

---

A - S I M P L E - P L A N by ARTiZEN a startingpoint for simple wikidot solutions.

Re: Suggestions for bulk upload by users

leiger 30 Jan 2011 05:00

Gabrys:

Till that time, we'll stick to the old API key method. Answering some of the questions and suggestions above, I would like to say that:

• users won't need to apply for the API keys
• each user will have two API keys: one read-only, one read-write
• we'll assign an URL at which users can see their keys (so that apps can ask them to go there)
• we're not going to allow anyone post as someone else or sometime else (changing page authors or dates of events after they happen)
• we're not going to let users create or modify their accounts or create sites via the API. API will be the way to modify the site contents once the site exists. Site and user creation must be done in-browser. Otherwise we get spammed heavily and we need to shut down the service.

All of this sounds great - thanks for the answers!

---

~ Leiger - Wikidot Community Admin - Volunteer
Wikidot: Official Documentation | Wikidot Discord server | NEW: Wikiroo, backup tool (in development)