Template talk:Pow

message: This template can be successfully exploited to DOS the servers, see discussion here. I suggest it be disabled, or at least changed in a way that requires it to be subst'ed and give an error message if it wasn't. If this cause pages using the template to break for a while, well, I think it's worth it nevertheless. A bot can later mass edit those back into shape. -- alexgieg (talk) 18:13, 9 May 2008 (UTC)
replies: text: Anyone who wants to do the same thing can make a template in their user space to do the same thing. If there is a DOS issue, the site admins should be alerted (using WP:VPT) and they will deal with it. But editing this template won't fix the issue, so I don't see the benefit of doing it. — Carl (CBM · talk) 18:45, 9 May 2008 (UTC)
replies: text: This template is used by nearly 14,000 pages so I'm reluctant to just disable it.  It's been around for a while without too many problems, so I think we can wait for a better solution than just turning it off immediately.  --CapitalR (talk) 18:47, 9 May 2008 (UTC)

text: Okay, I'll take a look now at rewriting this using the #iferror parser function to handle the errors.  I'm also going to see if there's a more efficient way of doing it besides the using the loop template.  --CapitalR (talk) 19:59, 9 May 2008 (UTC)
replies: text: I just added a bunch of #iferror constructs to the code to prevent exceptions.  Let me know if there's anything else you would like done to it.  --CapitalR (talk) 21:01, 9 May 2008 (UTC)

text: I'd be in favor of it doing that.  It doesn't seem like it should be that difficult of a feature to implement.  I just submitted a bug for this: . --CapitalR (talk) 00:19, 10 May 2008 (UTC)
replies: text: Ok, looks like this already works in the #expr function, so I killed off my bug request and Remember the Dot implemented it correctly.  --CapitalR (talk) 04:48, 10 May 2008 (UTC)
thread_title:  Exploitability 

message: Well, I can see how disabling the template would be problematic. In any case, after the fact I became curious about this template and played with it a little. The result is that I've found some bugs that need to be corrected, see here. The exploit was full of those red errors, so solving them might help some. -- alexgieg (talk) 19:29, 9 May 2008 (UTC)
replies: text: Okay, I'll take a look now at rewriting this using the #iferror parser function to handle the errors.  I'm also going to see if there's a more efficient way of doing it besides the using the loop template.  --CapitalR (talk) 19:59, 9 May 2008 (UTC)
replies: text: I just added a bunch of #iferror constructs to the code to prevent exceptions.  Let me know if there's anything else you would like done to it.  --CapitalR (talk) 21:01, 9 May 2008 (UTC)

text: I'd be in favor of it doing that.  It doesn't seem like it should be that difficult of a feature to implement.  I just submitted a bug for this: . --CapitalR (talk) 00:19, 10 May 2008 (UTC)
replies: text: Ok, looks like this already works in the #expr function, so I killed off my bug request and Remember the Dot implemented it correctly.  --CapitalR (talk) 04:48, 10 May 2008 (UTC)
thread_title:  Bugs then 

message: Okay, now that the template was replaced by Remember the dot to use the preprocessor exponentiation directly, some behaviors changed, some being bugs or almost bugs. Here's the list of what I identified, in no special order. Please edit the template contemplating whatever in it is appropriate:
# If you look at the transcluded documentation, you'll notice an obvious problem at the last example:  and  should both behave the same, resulting in "0.0001". The second one, however, is currently resulting in 15620. In short: both parameter should be encapsulated and evaluated to ensure the end result is correct.
# The formatting seems to be different. The second example, , is currently resulting in "1000000", but I remember that it previously resulted in engineering units, such as "1.000E+6" or something like that (I don't remember exactly how many decimal digits, sorry). I don't know whether this is a problem or not.
# The error checking that CapitalR had added is gone, so my playground is back to showing red error messages, although much simpler ones now than before. In my opinion, any situation in which non-numeric parameters where entered, or any parameter was missing, should result in a bold NaN link instead of giving some default numeric value, as a way to call attention to the fact there's a problem. What do you think? :-)
# Lastly, the transcluded documentation should be updated with the new limits and the new default behavior.
I think this sums it up. -- alexgieg (talk) 05:05, 10 May 2008 (UTC)
replies: text: There we go, how's that look to you?  Let me know if there's other things you would like done.  --CapitalR (talk) 05:13, 10 May 2008 (UTC)
replies: text: Thanks! And sorry for the work this caused. At least something good came out of it, as we have now 14,000 faster pages. :-) -- alexgieg (talk) 05:27, 10 May 2008 (UTC)
thread_title:  New bugs