Specify 7.12.1.1, docker. An unauthenticated GET to /context/user_resource/ or /context/user_resource/<id>/ returns HTTP 500. Reproduce with curl -o /dev/null -w '%{http_code}' https://<host>/context/user_resource/ from anywhere, no session: 500. Every other context endpoint answers a login redirect or 403 to an anonymous caller.
Cause, from the source: specifyweb/backend/context/user_resources.py builds user_resources and user_resource from Resources.as_view / Resource.as_view with filters that read request.specify_user, and there is no login_required / login_maybe_required on them, so an anonymous request fails inside the filter and the middleware turns it into a 500.
Why it matters to an admin: web crawlers find this URL (we get several hits a day from AWS-hosted bots on each of our nine hosts), and each one logs django.request: Internal Server Error: /context/user_resource/ in the app log and a 500 in nginx, indistinguishable from a real failure until you look up the client. A 403 would keep the logs honest.
Specify 7.12.1.1, docker. An unauthenticated GET to
/context/user_resource/or/context/user_resource/<id>/returns HTTP 500. Reproduce withcurl -o /dev/null -w '%{http_code}' https://<host>/context/user_resource/from anywhere, no session: 500. Every other context endpoint answers a login redirect or 403 to an anonymous caller.Cause, from the source:
specifyweb/backend/context/user_resources.pybuildsuser_resourcesanduser_resourcefromResources.as_view/Resource.as_viewwith filters that readrequest.specify_user, and there is nologin_required/login_maybe_requiredon them, so an anonymous request fails inside the filter and the middleware turns it into a 500.Why it matters to an admin: web crawlers find this URL (we get several hits a day from AWS-hosted bots on each of our nine hosts), and each one logs
django.request: Internal Server Error: /context/user_resource/in the app log and a 500 in nginx, indistinguishable from a real failure until you look up the client. A 403 would keep the logs honest.