segmentfault / report Goto Github PK
View Code? Open in Web Editor NEW关于SegmentFault旗下产品的bug,意见,需求
Home Page: https://segmentfault.com/g/segmentfault
License: Creative Commons Zero v1.0 Universal
关于SegmentFault旗下产品的bug,意见,需求
Home Page: https://segmentfault.com/g/segmentfault
License: Creative Commons Zero v1.0 Universal
返回顶部
,page过高了,返回顶部很麻烦http://beta.segmentfault.com/user/settings
修改城市的时候城市选择器,位置不对,并且保存不成功
浏览器 :Google Chrome
版本 35.0.1916.114 m
其实这不算一个bug,但是建议把所有的cookie设置为httponly,至少把session cookie之类的设置为httponly,这样可以让很多奔着cookie去的xss攻击无效
操作流程:撰写->存草稿(为了不影响,存草稿测试)->打开草稿编辑。
在编辑器输入:"/> <script>alert(111)</script>
浏览器:任意
操作系统:任意
结果:
displayBlock('tagList', Array, Array) #1 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Template.php(144): __TwigTemplate_03766b243ad363260900e2e615ac71dbac936f4fe9a8efcb109a30fadd9952cf->block_tagInput(Array, Array) #2 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Environment.php(331) : eval()'d code(54): Twig_Template->displayBlock('tagInput', Array, Array) #3 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Template.php(278): __TwigTemplate_03766b243ad363260900e2e615ac71dbac936f4fe9a8efcb109a30fadd9952cf->doDisplay(Array, Array) #4 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Template.php(252): Twig_Template->displayWithErrorHandling(Array, Array) #5 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Environment.php(331) : eval()'d code(45): Twig_Template->display(Array, Array) #6 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Template.php(278): __TwigTemplate_9b39a484a7cf3c2ad9500093fcecec4db90e8aabf91f7bc93e206671a54583da->doDisplay(Array, Array) #7 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Template.php(252): Twig_Template->displayWithErrorHandling(Array, Array) #8 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/lib/Twig/Environment.php(307): Twig_Template->display(Array) #9 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/app/Result/Twig.php(95): Twig_Environment->display('blog/write.twig', Array) #10 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/framework/Mvc/Response.php(145): SF\Result\Twig->render() #11 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/framework/Mvc/Server.php(141): L8\Mvc\Response->respond() #12 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/framework/Mvc/Server.php(43): L8\Mvc\Server->serve('blackhole+init+...') #13 phar:///www/segmentfault/packages/14.8.18.182110.2408707683.phar/framework/App.php(71): L8\Mvc\Server->__construct(Array) #14
另:没明白我的两个草稿是怎么来的。。。
复现步骤:
1.在一个问题下评论
2.删除这个评论
期望结果:评论数先+1后-1
实际结果:只+1没有-1
被hack的文章[http://beta.segmentfault.com/blog/p_chou/1190000000644115]
复现步骤:
在编辑文章的过程中,利用/api/draft接口,将ajax复制成curl,并添加post中的tag[]。文章会被保存成草稿,此时的草稿就是超过5个标签,然后提交文章。文章就有超过5个标签了。
实际结果:标签可超过6个
期望结果:draft接口应当验证标签的数量
测试用curl命令:
$ curl "http://beta.segmentfault.com/api/draft?_=f7d54c0227629dab3e5f49d942fe30b2" -H "Pragma: no-cache" -H "Origin: http://beta.segmentfault.com" -H "Accept-Encoding: gzip,deflate,sdch" -H "Accept-Language: zh,en-US;q=0.8,en;q=0.6,zh-CN;q=0.4,de;q=0.2,ja;q=0.2,zh-TW;q=0.2" -H "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" -H "Accept: */*" -H "Cache-Control: no-cache" -H "X-Requested-With: XMLHttpRequest" -H "Cookie: __utma=224849432.1675849558.1388304226.1396257644.1396314514.98; __utmz=224849432.1395978970.89.26.utmcsr=blog.segmentfault.com|utmccn=(referral)|utmcmd=referral|utmcct=/p_chou; PHPSESSID=lc0b76kpal4muq9bebaornb0h3; sfsess=eu7aiv.dc66c9987ce94159aa49337cbf23f5aa.a; Hm_lvt_e23800c454aa573c0ccb16b52665ac26=1408430341,1408495820,1408496848,1408595455; Hm_lpvt_e23800c454aa573c0ccb16b52665ac26=1408609585; _ga=GA1.2.1675849558.1388304226" -H "Connection: keep-alive" -H "Referer: http://beta.segmentfault.com/write?draftId=1220000000644067" --data "do=saveArticle&type=article&title="%"E6"%"96"%"B0"%"E6"%"B5"%"AASAE"%"E4"%"BD"%"BF"%"E7"%"94"%"A8"%"E7"%"BB"%"8F"%"E9"%"AA"%"8C&text="%"E5"%"95"%"8A122&weibo=0&blogId=1200000000373814&id=1220000000644067&tags"%"5B"%"5D=1040000000089658&tags"%"5B"%"5D=1040000000089399&tags"%"5B"%"5D=1040000000090145&tags"%"5B"%"5D=1040000000089436&tags"%"5B"%"5D=1040000000089387&tags"%"5B"%"5D=1040000000137810" --compressed
{"status":0,"data":"1220000000644067","message":""}
复现步骤
1.创建一个问题
2.问题创建人在问题页面,点击更多->删除
期望结果:问题删除
实际结果:ajax error
POST /api/question?_=0e33ca8dedd02e677a77af3591665017 HTTP/1.1
Host: beta.segmentfault.com
Connection: keep-alive
Content-Length: 43
Cache-Control: no-cache
Pragma: no-cache
Origin: http://beta.segmentfault.com
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Referer: http://beta.segmentfault.com/q/1010000000640973
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh,en-US;q=0.8,en;q=0.6,zh-CN;q=0.4,de;q=0.2,ja;q=0.2,zh-TW;q=0.2
Cookie: __utma=224849432.1675849558.1388304226.1396257644.1396314514.98; __utmz=224849432.1395978970.89.26.utmcsr=blog.segmentfault.com|utmccn=(referral)|utmcmd=referral|utmcct=/p_chou; PHPSESSID=3gt7bv3gn013l2u9raqj6b0ep3; _ga=GA1.2.1675849558.1388304226; Hm_lvt_e23800c454aa573c0ccb16b52665ac26=1408082059,1408323977,1408341983,1408430341; Hm_lpvt_e23800c454aa573c0ccb16b52665ac26=1408432381; sfsess=eu7aiv.dc66c9987ce94159aa49337cbf23f5aa.a
id=1010000000640973&do=delete&type=question
HTTP/1.1 500 Internal Server Error
Server: ASERVER/1.2.9-3
Date: Tue, 19 Aug 2014 07:24:14 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.9-1ubuntu4.3
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Powered-By-Anquanbao: MISS from chn-wh-tc-sb5
操作流程:点击邀请大大回答,选择站内邀请,随便输入一个用户名,点击确定。
操作环境:chrome
在一个用户的个人页面,看到他的某个回答,点击那个链接,会看到回答的问题和这个用户回复的答案。这个时候如果想修改 url 查看该问题的所有答案的话,修改后的 url 尾部最后不能有 /,不然会报 404 错误。
eg:
http://segmentfault.com/q/1010000000670031/a-1020000000680819
如果想查看所有答案,修改 url 为 http://segmentfault.com/q/1010000000670031/ 是不行的,会提示页面找不到,修改为 http://segmentfault.com/q/1010000000670031 就可以。
也许不是一个大问题,不过 SF 的用户可能会有在 Firefox 里用 vimperator 的,vimperator 执行这个操作的快捷键是 gu, 该操作执行后的 url 会带上 / , 所以最终转到的是 404,这个不太方便~
修改好评论,按一下 Tab,选中我的名字了?再按一下,「取消」???我好不容易改好了您第二推荐我的操作是取消????
PS: 我在这里按一下 Tab 就要我期待的那个绿色的提交按钮了而且还有明显的视觉反馈。Twitter 和 Google+ 也做得很好(除了他们偶尔改代码的时候会弄错几天)。
http://segmentfault.com/user/settings?tab=oauth
点击取消 QQ 的绑定没有任何反应
Request Header
POST /api/setting?_=<隐藏> HTTP/1.1
Host: segmentfault.com
Connection: keep-alive
Content-Length: 53
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
Origin: http://segmentfault.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
DNT: 1
Referer: http://segmentfault.com/user/settings?tab=oauth
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: <隐藏>
Request Body
do=unbind&type=qq&id=<隐藏>
Response Header
HTTP/1.1 404 Not Found
Server: ASERVER/1.2.9-3
Date: Fri, 19 Sep 2014 03:38:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.9-1ubuntu4.3
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
X-Powered-By-Anquanbao: MISS from chn-hz-wy-se2
1、搜索“空格”,或者其他特殊字符,如: @,',$%等。
2、在搜索结果页,注意“找到约xx条结果”提示和结果内容之间的区域内,会有一个空的“标签”。
3、点击后,弹出“页面也不到了”。
http://segmentfault.com/search?q=++
http://segmentfault.com/t/
重现场景:
未登录状态下,打开问题1,2,3
在问题1页面登录 -> 回跳到问题3
個人資料->新密碼處實在不知道填寫什麼。因爲微博登入的時候無需密碼。
所以,請判斷下把。
登陆,发现有草稿箱,编辑报404,舍弃也报404,应该是数据的完整性出问题了吧?
404一枚
http://segmentfault.com/api/draft?_=bbaebcbbe30b1410a22214dc61184e03"
http://segmentfault.com/user/settings
填写通讯地址提交后,刷新页面又变成空的。
Request Header
POST /api/setting?_=<隐藏> HTTP/1.1
Host: segmentfault.com
Connection: keep-alive
Content-Length: 824
Pragma: no-cache
Cache-Control: no-cache
Accept: */*
Origin: http://segmentfault.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
DNT: 1
Referer: http://segmentfault.com/user/settings
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: <隐藏>
Request Body
do=editProfile&name=%E7%8E%8B%E5%AD%90%E4%BA%AD&slug=jysperm&gender=1&birthday=1995-11-25&city=%E8%8B%8F%E5%B7%9E%E5%B8%82&homepage=http%3A%2F%2Fjysperm.me%2F&description=%E6%98%B5%E7%A7%B0%E3%80%8C%E7%B2%BE%E5%AD%90%E3%80%8D%EF%BC%8C18+%E5%B2%81%EF%BC%8C%E9%AB%98%E4%B8%AD%E9%80%80%E5%AD%A6%EF%BC%8C%E7%8B%AC%E7%AB%8B%E5%BC%80%E5%8F%91%E8%80%85%EF%BC%8C%E7%8B%AC%E7%AB%8B%E5%8D%9A%E5%AE%A2%E4%BD%9C%E8%80%85%EF%BC%8C%E6%B7%B1%E5%BA%A6+Github+%E7%94%A8%E6%88%B7%EF%BC%8C%E8%B5%84%E6%B7%B1%E6%AF%94%E7%89%B9%E5%B8%81%E7%8E%A9%E5%AE%B6%EF%BC%8C%E3%80%8C%E7%95%AA%E8%8C%84%E5%9C%9F%E8%B1%86%E3%80%8D%E4%B8%BB%E8%A6%81%E7%BB%B4%E6%8A%A4%E8%80%85%E4%B9%8B%E4%B8%80%EF%BC%8C%E3%80%8CRP+%E4%B8%BB%E6%9C%BA%E3%80%8D%E7%BB%B4%E6%8A%A4%E8%80%85%EF%BC%8C%E3%80%8C%E7%B2%BE%E8%8B%B1%E7%9B%92%E5%AD%90%E3%80%8D%E7%BE%A4%E4%B8%BB%E3%80%82
Response Header
HTTP/1.1 200 OK
Server: ASERVER/1.2.9-3
Date: Fri, 19 Sep 2014 03:44:19 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.9-1ubuntu4.3
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Cache-Control: no-cache
X-Powered-By-Anquanbao: MISS from chn-hz-wy-se2
X11 环境。
本来呢,在文本编辑区域点中键是可以粘贴 X11 主选择区的。X11 主选择区的内容通常就是当前选中的内容,可是回答框里选中的文本并不会被放到主选择区。
我设置了一些 Emacs 式的 GTK 编辑器,比如前后移动、到行首行尾、删除单词/到行首等,理应在所有 GTK 程序的文本编辑区都可用的,但是你们的回答区里不可以。
火狐里,在所有系统上,选中编辑区的文本时,用鼠标拖动时是可以移动选中文本的(相当于剪切)。如果拖动时按住 Ctrl 键是可以复制文本的。但是你们的回答区里拖动文本会弹出奇怪的框来。
当回答问题时,可以直接注入脚本。
产生过程:【提问题】模块,添加标签时,目测只能最多添加5个。当添加完4个后,第5个添加标签的编辑框就出现了错位,没有与其他4个保持水平。点击添加后,显示的第5个标签还是出现错位的情况。
期望结果: 5个标签能保持水平
实际结果: 第5个与前4个错位
附件: 图片死活传不上来。只好弄到OneDrive:https://onedrive.live.com/redir?resid=3A37A7F1FFCF56DD!455&authkey=!AHVnD3Xmo4TdKis&v=3&ithint=photo%2cjpg
环境: Ubuntu12.04 + Chrome 38.0.2125.0 dev (64-bit)
第五个标签 <li class="widget-addtags__input mt10">
,class中多了个“mt10”,
.mt10, .mt-10 {
margin-top: 10px; //这里
}
在这里http://segmentfault.com/blog/trigkit4/1190000000680773#articleHeader1 给文章评论时,提示文字好像样式没有调整好,还是说原本的就是这样子呢?
旧版本的「收藏」就是「订阅」的意思(如本页右边的「Subscribe」按钮)。所以它不需要分类。现在的「收藏」更接近知乎的「收藏」功能,所以需要分类了吗?
那么我仅仅要「订阅」一个问题的答案(知乎里叫「关注」)要怎么做呢?
通过微博文章传送门进来文章讨论页面的时候,点击登录,然后使用自己的github帐号登录之后直接跳到主页去了,然后,我想可不可以登录之后跳回到文章讨论页面并且我是登录状态呢?
Firefox 31.1.0 ESR
点击 copy 无法复制代码,chrome 里是可以的
这样当我希望看到一个回答的受认可程序时,我只需要看一个地方。
提交密码修改报ajax error
前俩个“站内邀请”“Email邀请”都有验证是否输入xx名。
http://segmentfault.com/q/1010000000680965#a-1020000000682133
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.