Googlebot deleted my website
So due to some really bad coding on our part, googlebot managed to wipe out a bunch of web content on one of our webpages today. The webpage is setup so that the individual pages all include a small piece of php code that pulls it’s content out of an SQL database and spits it out. We set this up for particular pages so that the user can make changes to the content with an HTML editor in a /admin sort of setup. It’s not the fanciest, but it’s simple, efficient and reliable.
Well the customer calls me this morning and tells me that all their content is missing, which I quickly confirm to be fairly accurate. I fire back an e-mail saying that the pages must have been deleted through the admin interface because the missing pages have been removed from the database. I then go off to read logfiles with the intent of finding evidence that this customer blew up their own webpage and that it’s not my problem, because that’s how I think. Here’s what I find in my logs:
66.249.73.92 - - [02/May/2008:13:48:47 -0400] “GET /admin/website_pages_delete.php?id=25 HTTP/1.1″ 200 4642 “-” “Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)”
66.249.73.92 - - [02/May/2008:13:52:39 -0400] “GET /admin/website_pages_delete.php?id=26 HTTP/1.1″ 200 4760 “-” “Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)”
66.249.73.92 - - [02/May/2008:14:10:44 -0400] “GET /admin/website_pages_delete.php?id=42 HTTP/1.1″ 200 4642 “-” “Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)”
4 Comments, Comment or Ping
adam
Hah, that’s like a self inflicted XSS/CSRF attack
Good job there!
You had backups right?!
May 6th, 2008
Ken Collinds
All destructive actions should be behind a POST
Hopefully you had DB backups?http://www.hrgeeks.com/wp-content/themes/grid-focus-public-10/images/btn_submit.gif
May 6th, 2008
Geoff
before_filter :is_admin?, is_google_bot?
And while we’re at it anything that deletes should be handled via a DELETE request…
May 6th, 2008
adam
You REST goons are funny. REAL web servers don’t support DELETE
May 9th, 2008
Reply to “Googlebot deleted my website”