278077 - Editing a non-existing file ends up changing the 404 page

Status: RESOLVED WONTFIX

(www.mozilla.org :: General, defect)

Description

[Ben Bucksch (:BenB)]

Reproduction:
1. Go to <http://www.mozilla.org/docs/web-developer/foobar.html>
2. Click "Edit this Page"
3. Edit the page
   (default content will be the 404 page, which is odd,
   but makes sense in a way.)
4. Review Changes
   (will give you a diff to the 404 page, which is even more odd,
   seemed like a bug/misfeature steeming from the above)
5. Commit
   (Works fine, appearantly)

Actual result:
You change the 404 page itself, i.e. <http://www.mozilla.org/houston.html> also
delivers your <http://www.mozilla.org/docs/web-developer/foobar.html>.

That's because in step 3, you were actually at
<http://doctor.mozilla.org/?file=mozilla-org/html/404.html>, which I didn't
notice. Note, however, that in steps 1 and 2, you were indeed at
<http://www.mozilla.org/docs/web-developer/foobar.html> (which is correct).

Expected result:
You create a new page on <http://www.mozilla.org/docs/web-developer/foobar.html>
only, 404 page unchanged.

Information:
The right way would have been to go to <http://doctor.mozilla.org/> and enter
the desired new URL or (I guess) to manually go to
<http://doctor.mozilla.org/?file=mozilla-org/html/docs/web-developer/foobar.html>.

Severity:
Can easily create noticable havoc, so major or even critical.

Comment 1

[Anne (:annevk)]

This is intentional and has nothing to do with doctor, by the way. I propose
INVALID.

Comment 2

[Anne (:annevk)]

dbaron, perhaps the error pages should be restricted as well? Just like
/.htaccess and similar files?

Comment 3

[Ben Bucksch (:BenB)]

That's a bug in Doctor, as far as I am concerned. It should not silently do
something else than I told it.

If I have <http://www.mozilla.org/docs/web-developer/foobar.html> in the URLbar
and click "Edit this page", I expect to edit that URL's document (which is
currently empty), not the 404 page.

E.g. emacs behaves the same, if you "open" and edit a non-existant file.

Anne: No need to "protect" them (from people with login), if you don't
accidently edit them.

Comment 4

[Ben Bucksch (:BenB)]

Anne points out that the "Edit this page" link at the bottom of
<http://www.mozilla.org/docs/web-developer/foobar.html> already points to
<http://doctor.mozilla.org/?file=mozilla-org/html/404.html>. So, the main bug
here in actually for webmaster, as Anne said. Changing component back on her
request.

Doctor could still add a layer of protection by checking REFERER header, if it
different from the edited URL. (But you cannot rely on REFERER being there.)

Comment 5

[David Boswell]

Marking as wontfix.  Doctor is no longer being maintained so there won't be a fix coming for this.  We are looking at moving from Doctor to another editing tool however, but that's another bug.