Merge branch 'gist-comment-uris'

Peter Williams · Peter Williams · commit 7edc23cdbad4 · 2012-10-31T11:03:11.000-06:00
Conflicts:
	lib/resources.rb
diff --git a/content/changes/2012-10-31-gist-comment-uris.md b/content/changes/2012-10-31-gist-comment-uris.md
@@ -0,0 +1,10 @@
+---
+kind: change
+title: Gist comment URIs
+created_at: 2012-10-31
+author_name: pezra
+---
+
+The URIs of all gist comments are changing immediately. The new URI pattern for gist comments is `/gists/{gist-id}/comments/{id}`. (See [gist comments section of the docs](/v3/gists/comments/) for more details.) This change is necessary because the auto-incremented id of gist comments is easy to guess. This predictability allows anyone to view comments on private Gists with relative ease. Obviously, comments on private gists should be just as private as the gist itself.
+
+Adding the id of the gist id to the URI makes it impossible, in practical terms, because that id is a very large random number. This is, unfortunately, a breaking change but one that cannot be avoided because of the security implications of the current URIs. We apologize for the inconvenience.
diff --git a/lib/resources.rb b/lib/resources.rb
@@ -2,6 +2,7 @@
 require 'yajl/json_gem'
 require 'stringio'
 require 'cgi'
+require 'securerandom'
 
 module GitHub
   module Resources
@@ -677,7 +678,7 @@ def text_html(response, status, head = {})
     GIST_HISTORY = {
       "history" => [
         {
-          "url"     => "https://api.github.com/gists/1/57a7f021a713b1c5a6a199b54cc514735d2d462f",
+          "url"     => "https://api.github.com/gists/#{SecureRandom.hex(10)}",
           "version" => "57a7f021a713b1c5a6a199b54cc514735d2d462f",
           "user"    => USER,
           "change_status" => {
@@ -690,11 +691,12 @@ def text_html(response, status, head = {})
       ]
     }
 
+
     GIST_FORKS = {
       "forks" => [
         {
           "user" => USER,
-          "url" => "https://api.github.com/gists/5",
+          "url" => "https://api.github.com/gists/#{SecureRandom.hex(10)}",
           "created_at" => "2011-04-14T16:00:49Z"
         }
       ]
@@ -707,7 +709,7 @@ def text_html(response, status, head = {})
     }
 
     GIST = {
-      "url"          => "https://api.github.com/gists/1",
+      "url"          => "https://api.github.com/gists/#{SecureRandom.hex(10)}",
       "id"           => "1",
       "description"  => "description of gist",
       "public"       => true,
@@ -725,7 +727,7 @@ def text_html(response, status, head = {})
 
     GIST_COMMENT = {
       "id"         => 1,
-      "url"        => "https://api.github.com/gists/123/comments/1",
+      "url"        => "https://api.github.com/gists/#{SecureRandom.hex(10)}/comments/1",
       "body"       => "Just commenting for the sake of commenting",
       "user"       => USER,
       "created_at" => "2011-04-18T23:23:56Z"
