A website-info page is a small, boring document that later readers treat as fact: PHP version, generator name, template family, perhaps the OS the station PC ran. If that page can be edited without a session, an anonymous visitor can rewrite the station’s provenance. The historical TNET URL /aboutus/websiteinfo&action=login is the access-control article for that risk.
The public document those editors were changing is /aboutus.websiteinfo. This URL does not replace that document. It explains why generator metadata was write-gated. No login form is offered, and no historical accounts are restored.
Historical context
Hobby weather templates often printed a footer such as “generated by …” or a dedicated About child that listed Apache, PHP, GD, and the station program. Those strings were used the way a laboratory notebook uses instrument serial numbers. Forum diagnostics started from them: “your banner is blank, what PHP and GD does the host have?” A vandalized info page that still sat next to correct gauges was more harmful than an obviously defaced home page, because helpers would debug the wrong stack.
PHP CMSs therefore reused action=login on the website-info node. The public GET stayed open. The POST that changed generator lines required a session. Crawlers stored the editor URL. The inventory keeps it as a 200 article about that gate.
Why this metadata is worth protecting
Generator and stack lines are not weather. They are source identity for the publishing chain. A later parser that assumes Cumulus realtime.txt because the hostname says cumulus will still fail if the page was actually a Weather Display theme on a different PHP build. The software-declaration article covers the station program. Website-info covers the host and generator that turned files into HTML.
Vandalism patterns that matter here:
False generator. Replacing “Cumulus MX extra files” with a competitor’s name, or with “hand-written HTML,” sends the next maintainer to the wrong field list.
False runtime. Changing PHP 5.2 to PHP 8, or claiming GD when the host never had it, explains a banner failure that never happened and hides the one that did.
Injected stack. Adding analytics hosts, “partners,” or download URLs to an info page is spam with a lab-notebook costume.
Deleted limitations. Removing “Windows-only Cumulus 1” or “realtime file optional” turns a constraint into a mystery.
None of those change the thermometer. All of them change whether an archived site can still be interpreted. That is why a session sat on this noun even though the page looks like a credits scrap.
Sessions versus preference cookies versus archive access
The editor session cookie meant: this browser may change the website-info document. It should have been checked on the server at write time (OWASP session management, last checked 13 August 2026).
Visitor preference cookies (units, language) must not open that write. A °C toggle is not an admin proof. If the info page describes cookies, that description belongs in the public document and in the cookie-policy cluster, not inside the session token.
Archive access on the modern host means the website-info article is readable without an account. It does not mean the old CMS user table is available. Do not send passwords. Do not treat a Wayback login screenshot as a restored service.
What a gated editor should have been allowed to change
Least privilege again, tied to this node rather than to the whole About tree:
| Field | Listing editor with session | Why |
|---|---|---|
| Generator name and version as actually running | Yes | That is the document’s job |
| PHP / GD / OS notes that match the host | Yes | Diagnostics depend on them |
| Link to phpinfo-style public dumps | Prefer no | Those dumps leak configuration |
| Station climate values | No | Wrong object |
| Software license lines for Cumulus/WD | Prefer the software-credits gate | Different vandalism (attribution) |
| Project ZIP URLs | Prefer the project-listing gate | Different vandalism (fake downloads) |
Splitting those gates looks like CMS noise. It is how a stolen session on credits does not automatically rewrite the PHP version, and the reverse.
Distinct from the website-info document
/aboutus.websiteinfo answers: what was this site built with. This login URL answers: who was allowed to say so. Copying the stack list into this article would make the pair duplicates and would pre-empt the document another pass is writing. Link it; do not clone it.
The hub login at /aboutus&action=login is the general About editor. Website-info is the subset of About that outsiders treat as a configuration record. Configuration records attract a quieter, more damaging class of edit than a changed hobby biography.
Practical checklist for preserving stack notes
- Keep generator, runtime, and station-program identity in a public page that does not require a session to read.
- Require a session (or a git commit, or a host file manager) to write.
- Do not publish credentials, directory listings, or full
phpinfooutput as “website info.” - When you quote an old info page, quote it as historical and dated; PHP versions move.
- If you find
&action=loginon this path in a log, cite the exact string and treat it as an editor request, not as missing content. - Keep visitor cookies out of the admin path.
Modern relevance
Software bills of materials and generator meta tags are the same idea with better vocabulary. They are still vandalism magnets because they are trusted and rarely re-read. TNET’s public work on source identity, units, and freshness for weather records used in connection research is data sources, quality controls, and methodology. A generator string is source identity for HTML, not an atmospheric observation. Observed versus derived labeling remains how the service works. The Cumulus hub lists the About cluster. For the stack document itself, use website info.
Sources
- OWASP: Session Management Cheat Sheet (last checked 13 August 2026)
- RFC 6265: HTTP State Management Mechanism (last checked 13 August 2026)
- PHP: phpinfo (last checked 13 August 2026)
- TNET, Data sources, quality controls and methodology
- TNET, How the service works