[$50]Comment out blog component and calls

[sushilshinde]

1. Search for api/proxy-get?url in the community app repo
2. Comment out related components and calls in the app

It is P0, take it if you can submit in 4 hours or I will revoke the issue.

Use https://github.com/topcoder-platform/community-app/tree/hot-fix for PR

@topcoder-platform/topcodercompetitors @topcoder-platform/tcxcommunity this is open for pickup

[crazyk07]

Contest https://www.topcoder-dev.com/challenges/30107318 has been created for this ticket.

This is an automated message for crazyk via Topcoder X

[crazyk07]

Contest https://www.topcoder.com/challenges/30107320 has been created for this ticket.

This is an automated message for crazyk via Topcoder X

[crazyk07]

Contest https://www.topcoder.com/challenges/30107320 has been updated - the new changes has been updated for this ticket.

This is an automated message for crazyk via Topcoder X

[crazyk07]

Contest https://www.topcoder.com/challenges/30107320 has been updated - it has been assigned to anonymousjaggu.

This is an automated message for crazyk via Topcoder X

[crazyk07]

Contest https://www.topcoder.com/challenges/30107320 has been updated - it has been assigned to rashmi73.

This is an automated message for crazyk via Topcoder X

[rashmi73]

@sushilshinde PR #3462

[cwdcwd]

after reviewing at the code, fails to actually address the security issue which is this.

the community app allows for unfettered internal access by proxying calls through the application
this is a pretty ridiculous thing to do and I’m not sure why this was ever introduced, tbh, but the code issue is not the RSS feeds but the proxying that the RSS feeds utilize

testing on dev shows that this issue is not resolved as well
@rashmi73 @ThomasKranitsas see above mentioned line of code

[Oanh-and-only-Oanh]

Disabling the search UI on PROD in the meantime. @sushilshinde

[rashmi73]

@cwdcwd @sushilshinde I am confused as what exactly is remaining now?

1. Do I need to completely comment out the code at

   community-app/src/server/index.js

   Line 163 in 63d2907

   server.use(

2. or just I need to remove "checkAuthorizationHeader" argument at

   community-app/src/server/index.js

   Line 163 in 63d2907

   server.use(

I guess requirements were met as mentioned in issue description.

Kindly confirm above so I immediately raise another PR.

[Oanh-and-only-Oanh]

@rashmi73, this issue and ticket are no longer relevant. Thank you for your work on this. Closing out the ticket and will process your payment. :)

[rashmi73]

@sushilshinde no paid label on it?

[rashmi73]

@Oanh-and-only-Oanh @sushilshinde payments are not reflecting in pacts yet, can you please confirm once again? thanks

[sushilshinde]

Commented endpoint as well

23392a2

and now

https:///community-app-assets/api/proxy-get?url=https%3A%2F%2Fwww.topcoder.com%2Fblog%2Ffeed%2F

should not work, which is expected

[rashmi73]

@sushilshinde can we please complete the payment process nowitself? rather delaying it if everything is completed thank you

[sushilshinde]

@rashmi73 let me know if payment processed EOD today

[rashmi73]

@sushilshinde thanks, but can we please also take a look at #2696, because PR was merged in the code and working well

[rashmi73]

@sushilshinde payment is not reflected in pacts yet. can you please confirm once again thanks

[sushilshinde]

@rashmi73 payment is not reflected in both the tickets?

if that is the case please open a ticket with support

[rashmi73]

@sushilshinde yes payment is not reflected for both tickets, mailing to support with url of both issues

[rashmi73]

@sushilshinde I received a mail from support which is guiding you to go to these both links:
https://www.topcoder.com/direct/contest/detail.action?projectId=30094926

https://www.topcoder.com/direct/contest/detail.action?projectId=30107320

and assign me (rashmi73) for payment, because there are multiple people on above challenge hence need to select correct person.

[sushilshinde]

@rashmi73 @RiteshTC I will create a separate payment ticket.

I will remove payment information from these two tickets.

[rashmi73]

@sushilshinde I hope payment for this will be done too