POST /data/tag

[PGijsbers]

[PGijsbers]

Authentication happens after checking whether something is already tagged. This should be reversed as it may leak private information. People are also not restricted from tagging private entities they do not own, which is probably also an oversight.

[PGijsbers]

There is seemingly no input validation on the PHP endpoint.

curl -v -X POST -d 'api_key=VALID_TEST_KEY&data_id=1&tag=w/lR×Í??Ø' https://test.openml.org/api/v1/json/data/tag

uploads fine:

I have added input validation to the reimplementation. Specifically it adheres to SystemString64 as defined in the dataset.xsd.

[PGijsbers]

Confirmed oversight, Jan even wants to patch it in PHP.