<p></p>
<p><b>@tomhughes</b> commented on this pull request.</p>

<hr>

<p>In <a href="https://github.com/openstreetmap/openstreetmap-website/pull/4617#discussion_r1550137336">app/controllers/application_controller.rb</a>:</p>
<pre style='color:#555'>> @@ -206,13 +206,13 @@ def web_timeout(&block)
     if e.is_a?(Timeout::Error) ||
        (e.is_a?(ActiveRecord::StatementInvalid) && e.message.include?("execution expired"))
       ActiveRecord::Base.connection.raw_connection.cancel
-      render :action => "timeout"
+      render "browse/timeout", :layout => map_layout
</pre>
<p dir="auto">I know you change it again later but I don't think it's reasonable to have this as an intermediate step as it leaves the site broken - the while point of only setting an action was to render the timeout action for the current controller because timeouts can occur in different controllers.</p>
<p dir="auto">I think this needs more though about how to do this change and the following one to ensure we keep things roughly working through each step.</p>

<hr>

<p>In <a href="https://github.com/openstreetmap/openstreetmap-website/pull/4617#discussion_r1550144840">app/controllers/notes_controller.rb</a>:</p>
<pre style='color:#555'>> @@ -11,7 +11,7 @@ class NotesController < ApplicationController
 
   before_action :lookup_user, :only => [:index]
   before_action :set_locale
-  around_action :web_timeout
+  around_action :web_timeout, :only => :show
</pre>
<p dir="auto">Why are we removing this from the index action - the timeouts are an important protection against users finding a way to trigger expensive database queries and list/search methods like index are a key danger there.</p>

<hr>

<p>In <a href="https://github.com/openstreetmap/openstreetmap-website/pull/4617#discussion_r1550150619">app/views/changesets/timeout.atom.builder</a>:</p>
<pre style='color:#555'>> @@ -1,6 +1,6 @@
 atom_feed(:language => I18n.locale, :schema_date => 2009,
-          :id => url_for(params.merge(:only_path => false)),
-          :root_url => url_for(params.merge(:only_path => false, :format => nil)),
+          :id => url_for(params.permit(:format, :display_name, :bbox, :friends, :nearby).merge(:only_path => false)),
+          :root_url => url_for(params.permit(:format, :display_name, :bbox, :friends, :nearby).merge(:action => :index, :format => nil, :only_path => false)),
</pre>
<p dir="auto">We should probably factor out the <code class="notranslate">params.permit</code> into a variable to avoid duplicating it?</p>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />Reply to this email directly, <a href="https://github.com/openstreetmap/openstreetmap-website/pull/4617#pullrequestreview-1977460715">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AAK2OLOQTIHRU2LMQYW5JCDY3Q2WNAVCNFSM6AAAAABFEK64GCVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMYTSNZXGQ3DANZRGU">unsubscribe</a>.<br />You are receiving this because you are subscribed to this thread.<img src="https://github.com/notifications/beacon/AAK2OLMYN54NJACW6AP6KY3Y3Q2WNA5CNFSM6AAAAABFEK64GCWGG33NNVSW45C7OR4XAZNRKB2WY3CSMVYXKZLTORJGK5TJMV32UY3PNVWWK3TUL5UWJTTV3WT6W.gif" height="1" width="1" alt="" /><span style="color: transparent; font-size: 0; display: none; visibility: hidden; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0; mso-hide: all">Message ID: <span><openstreetmap/openstreetmap-website/pull/4617/review/1977460715</span><span>@</span><span>github</span><span>.</span><span>com></span></span></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/openstreetmap/openstreetmap-website/pull/4617#pullrequestreview-1977460715",
"url": "https://github.com/openstreetmap/openstreetmap-website/pull/4617#pullrequestreview-1977460715",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>