(tooling-trusted-releases) branch main updated: #1057 - don't expose cache endpoints in production

[ar...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

alitheg pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/main by this push:
     new 4f0fff0d #1057 - don't expose cache endpoints in production
4f0fff0d is described below

commit 4f0fff0d95259f2bcb286b9475cfed170fbe38b4
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Mon May 11 11:44:44 2026 +0100

    #1057 - don't expose cache endpoints in production
---
 atr/get/user.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/atr/get/user.py b/atr/get/user.py
index 7fe2ba39..6d3da83a 100644
--- a/atr/get/user.py
+++ b/atr/get/user.py
@@ -17,7 +17,10 @@
 
 from typing import Literal
 
+import quart
+
 import atr.blueprints.get as get
+import atr.config as config
 import atr.form as form
 import atr.htm as htm
 import atr.shared as shared
@@ -32,6 +35,9 @@ async def cache_get(session: web.Committer, _user_cache: Literal["user/cache"])
     """
     URL: /user/cache
     """
+    if config.is_production_mode():
+        return quart.abort(404)
+
     cache_data = await util.session_cache_read()
     user_cached = session.uid in cache_data
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org