Site not considered safe?

[Thomas R Bailey]

I got this recently when trying to validate a playlist.
What does this mean and why does it occur?

This url works fine http://www.trbailey.net/playlist
But this tosses the error: http://www.trbailey.net/xspf/xspf.php

Download location not considered safe.
Please do not attack this site. Thanks.

Is is the .php extension or what?
-Tom
xspfphp.sourceforge.net

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

[Sebastian Pipping-4]

Tom wrote:
> I got this recently when trying to validate a playlist.
> What does this mean and why does it occur?
>
> This url works fine http://www.trbailey.net/playlist
> But this tosses the error: http://www.trbailey.net/xspf/xspf.php

I get "Could not download from URL." for that one, instead.
It works fine in a browser so I guess you do user agent
detection in your PHP script?


> Download location not considered safe.
> Please do /not/ attack this site. Thanks.*
>
> Is is the .php extension or what?

No.  The validator only accepts URLs with the schemes HTTPS and HTTPS.
This restricting is mainly in place to deny using file:// URIs
so poeple cannot read file from the server's local hard disc.

If you're familiar with Python the validator's source code [1]
might be of interest to you.

Thanks for using the validator!



Sebastian


[1] https://trac.xiph.org/browser/websites/validator.xspf.org/

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist

[Thomas R Bailey]

Sebastian Pipping wrote:

Tom wrote:
  

I got this recently when trying to validate a playlist.
What does this mean and why does it occur?

This url works fine http://www.trbailey.net/playlist
But this tosses the error: http://www.trbailey.net/xspf/xspf.php
    

I get "Could not download from URL." for that one, instead.
It works fine in a browser so I guess you do user agent
detection in your PHP script?
  

Nope, no user detection in my script, it's a playlist generator. It wouldn't make any difference anyway. It's the validator that's making the request to my server, not my script to the validator. It's not the playlist itself or the domain name. The /playlist url comes from the same server and it works fine. It's named "index.php" rather than xspf.php if that makes a difference.

Did you make some recent changes to validation or .htaccess files?
Most of all is the curiosity that it worked last time I tested it about two weeks ago.

Download location not considered safe.
Please do /not/ attack this site. Thanks.*

Is is the .php extension or what?
    

No.  The validator only accepts URLs with the schemes HTTPS and HTTPS.
  

You mean http and https?
Both urls above qualify. Are you sure it's not barfing on the "xspf.php" as a file?

This restricting is mainly in place to deny using file:// URIs
so poeple cannot read file from the server's local hard disc.
  

I've dealt with the file issue myself. I've had the best luck using server config to deny certain domains and/or user agents.
I wrote a short article on the basics a couple days ago and I updated it today if you're interested.
http://www.trbailey.net/xspf/protection.html

But it's not much good if it won't validate valid playlist files.
-Tom

_______________________________________________
Playlist mailing list
Playlist@...
http://lists.musicbrainz.org/mailman/listinfo/playlist