Move /packages/<action> to a different path

[maartenba]

Based on #3124 (comment) and as discussed in an e-mail thread:

If a package named "Upload" is uploaded, NuGet.org has no way to distinguish between showing the package upload page, or the package details page.

We may consider moving the actions to, for example, /manage/packages/<action> (e.g. /manage/packages/upload) to distinguish these. Of course /packages/<packageid> would remain active.

This conflict will only happen for the number of action methods we have in the /packages route (approximately 4 to 6).

Note that there are various URLs (e.g. docs) pointing to the upload package route which will have to be updated as well.

[harikmenon]

The number of references within the docs arent that much and in our new site we can make the change easily

[yishaigalatzer]

This shouldn't wait for a new site. It's a trivial correctness change

[harikmenon]

Didn't mean to imply that we need to wait :). Go ahead!!!

[scottbommarito]

@harikmenon @maartenba Can you point me to where the references are within the docs? GitHub's search feature is not yielding useful results.

[harikmenon]

did you search on nugetdocs repo? I tried on the site as well and I cant find any references :). MIght also be good to clone the repo and search locally on the url to be sure.

[scottbommarito]

The GitHub search results weren't yielding anything, but I cloned NuGetDocs and found a couple references!

[harikmenon]

Perfect. Sweetness!!!

[scottbommarito]

Is that the only place I should look? The only references were in a doc in Contribute called "Branding the NuGet Gallery".

[harikmenon]

Yes. Not sure if we should retroactively update the blog posts.

Can you check the of repo as well!

[scottbommarito]

I'm not sure what you mean by "the of repo" is but I found no references to the old paths in the NuGet team blog so we don't actually need to worry about retroactively updating that.

[maartenba]

So fun thing is that when this change goes live, the first result here:
https://duckduckgo.com/?q=nuget+upload+package&ia=web

Will end up here:
https://www.nuget.org/packages/Upload/1.0.0

Still not sure if desired :-)

[harikmenon]

Hopefully the actual package will be called upload.net :)

[scottbommarito]

Should we delete the "upload" package to prevent any confusion with other users? According to this, we delete packages that are "attempting to make the gallery do something that it is not explicitly designed to do", which I believe this describes the package well.

[harikmenon]

Please reach out to the user and ask him to unlist.

[scottbommarito]

It's already unlisted (@maartenba unlisted it when we initially encountered the XSS attack) but that won't stop people from seeing the package with the direct link. Normally I wouldn't be concerned about that but given that the direct link is an old route and will clearly show in search results, people will be seeing the package and get confused, especially considering that it's empty and features an XSS attempt. I think we might want to completely remove it for now.

[harikmenon]

Sure, please let the customer know first and then delete.

[maartenba]

@scottbommarito Can this one be closed? Also the Upload package seems like a security probe to me, not sure what our terms and conditions state but this may be worth a delete :-)

[scottbommarito]

Yea I'll close it, I forgot to do it earlier because I didn't merge for so long. We should delete the Upload package.

[Pondidum]

Hi @maartenba - That package was mine, and yes you were correct about the probing nature of it. I was at NDC when updating another package of mine and just wondered what would happen with a package called Upload (or anything else with a reserved name). Once it was indexed and apparently caused no routing issues I forgot about it.

Sorry for any inconvenience caused.

[maartenba]

@Pondidum No worries, it's a good catch :-) (I'm on my way to another NDC, not sure if you'll be there?)

[Pondidum]

@maartenba unfortunately not - I can only afford to go to one per year (and I haven't managed to get accepted as a speaker...yet)

[maartenba]

Will cross my fingers for next time then. Cheers mate!