{"action":"created","issue":{"url":"https://api.github.com/repos/wikimedia/restbase/issues/288","labels_url":"https://api.github.com/repos/wikimedia/restbase/issues/288/labels{/name}","comments_url":"https://api.github.com/repos/wikimedia/restbase/issues/288/comments","events_url":"https://api.github.com/repos/wikimedia/restbase/issues/288/events","html_url":"https://github.com/wikimedia/restbase/pull/288","id":98197811,"number":288,"title":"Insecure POST request to MW api","user":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-07-30T15:30:51Z","updated_at":"2015-07-30T17:14:57Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/wikimedia/restbase/pulls/288","html_url":"https://github.com/wikimedia/restbase/pull/288","diff_url":"https://github.com/wikimedia/restbase/pull/288.diff","patch_url":"https://github.com/wikimedia/restbase/pull/288.patch"},"body":"Please note, this is not a finished job, I'm making this PR as a reference for discussion!\r\n\r\nAlthough this one looked simple, it uncovered some issues in URI tempting. In the ticket @gwicke suggests to use http://api.svc.eqiad.wmnet/w/api.php as an API uri, which is good for prod, but useless for tests and manual testing, bc it's an internal uri. So, in this PR I'm enabled request tempting for apiUrl in the action module. \r\n\r\nThe problem is that in `config.yaml` meant to be used for manual testing/non-prod env, the uri template still has to be `http://{domain}/w/api.php'. But URI object in swagger-router doesn't support that, more that that, templates like this completely break swagger-router.URI, so domain be substituted before creating a template. Previously it was solved by these lines: https://github.com/wikimedia/restbase/blob/master/mods/action.js#L111-L114 , but now this means we would have to recompile the template on each request, which is really expensive. I've tried to use reggae-based solution and recompile the URI template on each template evaluation, but it's really slow. In this PR I make templates support '{...}' syntax and add a $.default_uri magic variable, which is really ugly, but it's the most obvious and fastest solution I've found. Would be really great to hear some opinions on this.\r\n\r\nPS the test should still be created for host header, but I've postponed it until we decide on how to proceed with this.\r\n\r\nBug: https://phabricator.wikimedia.org/T107030"},"comment":{"url":"https://api.github.com/repos/wikimedia/restbase/issues/comments/126406779","html_url":"https://github.com/wikimedia/restbase/pull/288#issuecomment-126406779","issue_url":"https://api.github.com/repos/wikimedia/restbase/issues/288","id":126406779,"user":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"created_at":"2015-07-30T17:14:57Z","updated_at":"2015-07-30T17:14:57Z","body":"@d00rman So, adding support for both apiURI and apiRequest. Will update the PR."}}