The path /aboutus&action=login is a historical PHP CMS address: the About hub plus a query that requested an editor session. It is preserved as a 200 article because other sites linked it. It is not a sign-in screen, not a password reset, and not a claim that those accounts still exist.
This page explains the pattern: why a static About tree sat behind a session, how access control and cookies worked in that era’s hobby CMS, and how to read the URL in an archive. Child login aliases on projects, website info, software credits, and a truncated cookie-policy query have their own angles. This URL is the hub case: editing the About pages themselves.
Historical context
Personal weather sites were often PHP on shared hosting. The public saw temperature pages. The operator needed a way to change “about this station,” membership notes, and policy text without FTP of every HTML file. Common CMSs appended a query such as action=login to the current node. The same script that rendered /aboutus then branched: show the public article, or—if the request asked for login and the credentials later succeeded—open an editor for that node.
The ampersand in /aboutus&action=login is the fossil of that branch. In a well-formed query string the first separator is ?. Archives, rewritten URLs, and CMS routers sometimes emitted & as the first separator anyway. The inventory keeps the string that backlinks actually used.
No form is provided here. TNET does not restore the historical member table, session store, or password mailer.
What a session was
A session is server-side state keyed by a token the browser sends back, almost always in a cookie. After a successful authentication, the CMS stored “this browser may edit About” for a limited time. Later requests to /aboutus with that cookie could show edit controls; requests without it showed the public page.
Three kinds of cookie are easy to conflate on weather sites. They must stay distinct.
Session cookie. Identifies the editor (or the fact of an authenticated session). It is access control. It is not weather. It should have been first-party, short-lived, and not readable as a temperature.
Preference cookie. Units, language, or layout for visitors. The cookie-policy cluster is about documenting that storage. A preference cookie must not grant edit rights. Confusing the two is how a “°C/°F” toggle becomes an accidental admin hole.
Archive-access cookie or parameter. Some galleries and member areas used a separate token to see private photos or unlisted logs. That is still access control, not a measurement. This About-hub login was for editing static identity pages, not for a webcam gallery.
If a Wayback capture of this URL shows a password box, that capture is historical interface chrome. It is not an invitation to authenticate against the modern host.
Why About pages were session-gated
About text is easy to vandalize and hard to notice. A changed station name, a swapped email, or a replaced “powered by” line can sit for months while gauges still look correct. The public page must remain readable without a session—otherwise the site has turned identity documentation into a members-only wall. The write path is what the login query protected.
Typical privileges on such a node:
- create or edit the About hub and its children (policy, memberships, software credits, project list);
- publish or unpublish a child without deleting the URL;
- set whether a visitor preference cookie is described on the policy page.
Typical privileges it should not have had:
- rewrite
realtime.txtor climate logs; - install PHP from the About form;
- treat a preference cookie as proof of identity.
Access control that is only “hide the edit link in CSS” is not access control. The session had to be checked on the server when a write was attempted. That is the whole CMS lesson this URL still teaches.
How to read the URL in an archive
Researchers meeting &action=login in a crawl, an access log, or a forum signature should treat it as metadata about the old site’s editor, not as a live service.
- Strip the action to find the public node. The content identity is
/aboutus. The query names an operation on that node. - Do not follow it as a password entry. There is no restored account database to try passwords against, and there should not be.
- Do not infer that the page was private. Login queries on public CMSs usually mean “editor for this public page,” not “members-only article.”
- Record truncation separately. Sibling inventory paths end in
&action=lo. That is a cut query, documented on the cookie-policy truncated login article. Do not “correct” those paths in citations. - Preference cookies in the same capture are not sessions. A units cookie in the HTML is visitor state.
Archive access today means: the article is public, the historical session store is not, and TNET does not offer to recover old passwords.
Distinct from child login URLs
| Path | Gate that article explains |
|---|---|
| /aboutus&action=login (this page) | Editing the About hub’s static identity pages |
| /aboutus/projects&action=login | Who may add a project listing (spam, fake downloads) |
| /aboutus/websiteinfo&action=login | Protecting generator/stack metadata |
| /aboutus/wxsoftware&action=login | License and attribution lines on software credits |
| /aboutus/cookiepolicy&action=lo | Truncated login query on a policy URL |
Reuse of action=login does not make those articles the same. The query is a CMS verb. The noun is the page it was appended to.
Modern relevance
Static identity pages still need a write path that is not the public GET. Whether that path is a CMS session, a git commit, or a host file manager, the rules are the same: public read, authenticated write, session token distinct from visitor preference cookies, no fake “accounts restored” story when the software is gone.
TNET’s public distinction between kinds of information—observed, modelled, derived—is how the service works. A session cookie is none of those; it is access machinery. Source identity for weather records is data sources, quality controls, and methodology. The Cumulus hub lists the About cluster this query sat on. The public About node remains /aboutus.
Sources
- OWASP: Session Management Cheat Sheet (last checked 13 August 2026)
- RFC 6265: HTTP State Management Mechanism (last checked 13 August 2026)
- TNET, How the service works
- TNET, Data sources, quality controls and methodology