Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How does the "RSVP to google sheets" work? That's an extremely useful feature to have on a static site with no backend. It looks like it's related to this line:

$.post('https://script.google.com/macros/s/AKfycbzUqz44wOat0DiGjRV1g..., data)

... how does the security work on that, or can I RSVP to your wedding too?



  How does the "RSVP to google sheets" work?
I don't know how the wedding website works, but I've done some basic recording data to google sheets like so:-

1. Create 'google forms' one-page survey, gathering outputs into a spreadsheet.

2. Use browser debug tools to figure out form field names, which will be things like 'entry.1150050082'

3. curl "https://docs.google.com/forms/d/ 1xFOZk3D1...wnIjGAf0/formResponse?ifq&entry.1150050082=FOO&entry.1477423851=BAR&entry.592766186=BAZ&submit=Submit" or the appends a row to the google sheet with the values FOO, BAR and BAZ.

I assume if your site embedded a form that sent the same request as that curl query, it would do the same thing.

Obviously, this isn't going to win you any awards for highly maintainable professional design at work. But if you want something quick and you aren't fussed about whether it works a year from now, it can get the job done.


He is referring to https://github.com/dwyl/learn-to-send-email-via-google-scrip...

It would be quite easy to check the rsvp code in appscript. E.g. have a sheet with all the guests, and give a random number (rsvp code) to each guest. Then on each rsvp request you could check whether that rsvp code exists in the code column. If yes: you'll add the answer to that row. If no: return an error.


Yes, I found it extremely helpful too. You can only RSVP if you have the invite code. If you don't then you can't RSVP.

You can store the code in a particular box in the sheet and then your google script can validate the code entered by the guest.


You are checking the invite code in the browser side js. That doesn't keep any tech-savvy user from registering even without code. Is this correct?


Yes, that's correct for my site currently. But what I had in mind is to have the invite code in the sheet itself and then when one submits, I check the entered code with the code in the sheet and then add/not add the rsvp.

However, due to timing constraints, I couldn't do this and instead used a simple encryption algorithm to have the hacker at least put in some effort to know the invite code :)

I will raise an issue on github for this.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: