Sign inRegisterCheck connection

Restricting Who Can Add a Project Listing

Project listings under About were login-gated because open catalogs attracted spam and fake downloads. How access control protected the index.

Back to Cumulus weather software guides

An About page that lists “our projects” is a catalog of names other people will download, cite, and install on weather PCs. If anyone can add a row, the catalog becomes an advertising wall and a malware vector. The historical TNET URL /aboutus/projects&action=login is the access-control article for that risk. It is not a sign-in form, and it is not a restored uploader.

The public information-architecture of About versus /projects is /aboutus/projects. The generic About-hub session pattern is /aboutus&action=login. This URL is the narrower problem: who was allowed to create a project listing, and why that write was gated when the read was not.

Historical context

Hobby weather indexes mixed genuine helpers (a GD banner, a dayfile parser, a server check) with the same abuses every public directory saw in the PHP era: injected “download” links, copied ZIP names, and forum spam that used a respected hostname as camouflage. A project row is more dangerous than a typo on an About paragraph. A visitor who trusts the station site may fetch whatever URL the row points at and run it next to realtime.txt credentials.

CMS practice was to show the list to everyone and to require a session to add or edit a row. The query action=login on /aboutus/projects is that write gate, preserved because crawlers and signatures stored the editor URL. TNET does not rehost packages and does not accept new listings through this page.

Why a public list still needs a private write

Three failure modes are specific to project catalogs.

Spam as weather. A row titled with a station keyword and a body that is a pharmacy link wastes editor time and, in an archive, looks like part of the historical toolkit. Session-gated creates stop anonymous inserts. They do not stop a stolen session; they change the default from “open blog comments” to “known editor.”

Fake downloads. A listing can name a real helper and point at a different binary. Operators who arrived from the Cumulus Wiki script catalog (last checked 13 August 2026) had reason to trust this hostname. That trust is exactly what a fake download spends. Access control on the listing is not a substitute for checksums and licenses on a real distribution site. It is the first filter on which URLs are claimed here.

Name collision. Two rows called “realtime log” that point at different files are a provenance failure. A session-backed editor can enforce uniqueness, a license field, and a link to the deep article instead of a raw ZIP. Anonymous inserts cannot.

The public /projects map already refuses to be a ZIP cabinet. The About listing is the identity catalog—the list a footer might cite as “this site’s helpers.” Identity catalogs are high-value graffiti surfaces. Gate the write.

Sessions, roles, and what a listing editor should have been allowed to do

A session cookie proved that someone in the editor table was present. It did not need to be a full host administrator.

A least-privilege split that matches the URL:

| Action | Public | Listing editor | Host admin | |---|---|---|---| | Read the About project list | Yes | Yes | Yes | | Add a name, one-line problem, license, link to a child article | No | Yes | Yes | | Point a row at an arbitrary off-site binary | No | No, unless policy says otherwise | Rarely, and documented | | Delete spam | No | Yes | Yes | | Change station climate files | No | No | Separate path | | Restore visitor preference cookies | No | No | No—those are not this gate |

Preference cookies (units, language) must not grant listing rights. Archive access to historical project articles is public on TNET; archive access to a historical session store is not offered. There is no password recovery here.

If a capture of this URL shows a login form, treat it as historical chrome. Do not submit credentials to the modern host.

Distinct from the hub login

The About hub login is about editing static identity prose: station story, contact path, policy pointers. A compromised hub session can embarrass. A compromised project-listing session can distribute a file. The extra query on /aboutus/projects exists because the CMS attached the verb login to the noun that needed the stronger write policy.

Do not collapse this article into “CMS sessions in general.” The object being protected is a catalog row that other operators might execute.

Practical rules for anyone who still runs a public helper list

  1. Public GET, authenticated POST. Never a write from an anonymous form.
  2. Session cookie distinct from visitor preference cookies; HttpOnly and a short idle timeout are the baseline described in the OWASP session management cheat sheet (last checked 13 August 2026).
  3. Store a license identifier and a documentation URL, not only a filename.
  4. Prefer linking a TNET child article or an upstream archive with its own notices over a fresh anonymous ZIP.
  5. Log who added a row. A catalog without an audit trail cannot be defended later.
  6. In citations, keep &action=login when that is the URL you found; explain it as an editor artifact.

TNET’s own preservation choice is the fourth rule applied globally: names and problem statements stay; binaries with unclear rights do not.

Modern relevance

Directory spam moved from PHP CMS comments to GitHub issues and package registries. The weather-site version is still a catalog of runnable helpers next to live observations. Gating who may add a name is quality control on source identity for software, the same discipline a later reader needs when deciding whether a graph came from a dayfile or from an unknown download.

TNET’s public discussion of source identity for weather records is data sources, quality controls, and methodology. How the service labels observed versus derived information is how the service works. The Cumulus hub indexes the project map and the About cluster. For the navigation split this gate sat on, return to projects under About.

Sources