learning-unlimited/ESP-Website — pull request #196 by gkanwar (2011-12-07 05:47:38+00:00)
Title: QSD caching potential fix

This is the fix I have right now. In the javascript it makes an additional AJAX request to the varnish_purge page that I created. This page then purges the correct page from the cache.

The gaping hole is that varnish_purge is currently accessible by anybody. I couldn't think of a good way to limit it to the correct subset of people. If I made it admin required, then anybody who could edit QSD but wasn't an admin would have issues (I don't know if there's any of these users, or if this contingency should be handled at all... if not then this is probably the best solution). If I made it based on qsd editing userbits, then it would take a perfectly general function and make it very restricted. If I made it just check for logged in, then any student could purge any page.

Any thoughts on good ways to resolve this?

Thanks!