Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Adding new actions to YOURLS API : a thing to ponder
- Currently the set of action available in the API is voluntarily limited to a few "non destructive" actions (no editing or deleting) because there's a passwordless way of doing things (signature token or signature token + time hash, see wiki page http://code.google.com/p/yourls/wiki/PasswordlessAPI)
- I think passwordless destructive actions might be a little too dangerous to allow : no big deal if someone steals your signature token to add spam links, but pain in the ass if it's used to modify or delete all your links
- Options :
- - require login + pwd for destructive actions ? might be a bit limiting
- - adding a new "super power" signature token that would be more secret, once/if there is a proper user & privileges management in YOURLS
- - maybe another option to consider is having a YOURLS plugin that will register custom API actions
Advertisement
Add Comment
Please, Sign In to add comment
