zghera / step-portfolio Goto Github PK

Make sure to run any new comment before adding it to the Cloud Datastore. Some of the types of inputs that should be rejected or modified includes:

• Comments that contain <script> or other HTML tags that could cause an HTML Injection or XSS attack.

• "Edge inputs" such as an empty string.

• Do some research to see if there are other types of harmful inputs that I should prevent.

As mentioned in #17, it is suggested that a user should only be able to delete or edit comments that they made. The best solution for this problem may be using Authenticator API for users to sign in so they only have the option to delete their own comments.

In cases where there is an error communicating with the database, there should be a clean, clear, and consistent method to notify the user what type of issue has occurred. So far, this could occur when:

• Fetching all of the comments stored in the Datastore.
• Fetching the Blobstore url in order to push images to the Datastore alongside their comments.

An entire new error html page could be created or some time of notice bar near the top of the screen. Some research should be done to determine a simple yet effective solution for displaying these types of errors.