LSTOWN-L Archives

LISTSERV List Owners' Forum

LSTOWN-L

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Topic: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Paul Russell <[log in to unmask]>
Thu, 25 Jul 2002 10:02:05 -0400
text/plain (48 lines)
I suspect that Pete did the same thing I do when I want to publish a
direct link to a restricted URL on the LISTSERV server: he edited the
URL to remove his email address and password cookie.

I started with a real URL to create the following examples, but modified
it to ensure that I did not accidentally reveal meaningful information.

Example 1: Unedited URL copied from my browser location box (wrapped for
ease of reading):

     http://listserv.bogus.tld/cgi-bin/wa?A2=ind0207&L=bogus-l
     &F=&S=&X=1A2B3C4D00D4C3B2A1&[log in to unmask]&P=1484

Example 2: Edited URL for publication:

     http://listserv.bogus.tld/cgi-bin/wa?A2=ind0207&L=bogus-l&P=1484

The parameter list in the URL begins with a question mark (?), and an
ampersand (&) marks the beginning of a new parameter name. The parameters
are like list keyword statements, i.e., the parameter name is followed by
an equal sign (=) and the parameter value. Parameters with null values can
be removed from the URL for brevity. 'A2' is the log file name, 'L' is the
listname, 'P' is the message (post) number, 'X' is the password cookie,
and 'Y' is the email address.

To create the URL which I want to publish, I removed 'F' and 'S' for
brevity, and 'X' and 'Y' for reasons which should be obvious.

If the URL in example 2 was valid, it would take the user to message
number 1484 in the July 2002 archives of the BOGUS-L list on the server
listserv.bogus.tld. If the list archives were restricted in any way, and
the user had not previously saved his/her password cookie on his/her
workstation, he/she would be prompted by LISTSERV to login with his/her
email address and LISTSERV password. Access to the archived message would
be granted or denied based on the list configuration.

On Wed, 24 Jul 2002, Ahern, Shannon <[log in to unmask]> wrote:

>So, here is the reply I got from my technical staff fellow, although I
notice that *your* samples below do NOT include your login info. How did you
do that?

--
Paul Russell
Senior System Administrator
O&E Messaging Services Team
University of Notre Dame

ATOM RSS1 RSS2