Remove bogus 1-star reviews

[goddard@…]

The following bug report has been submitted:
Platform:        Windows-10-10.0.18362
ChimeraX Version: 1.0rc202005140520 (2020-05-14 05:20:29 UTC)
Description
The bogus all 1-star reviews on ToolShed for almost every bundle need to be removed before 1.0 release.

Log:
UCSF ChimeraX version: 1.0rc202005140520 (2020-05-14)  
© 2016-2020 Regents of the University of California. All rights reserved.  
How to cite UCSF ChimeraX  




OpenGL version: 3.3.0 NVIDIA 442.19
OpenGL renderer: GeForce GTX 1080 Ti/PCIe/SSE2
OpenGL vendor: NVIDIA Corporation
Manufacturer: Gigabyte Technology Co., Ltd.
Model: Z270X-Gaming K7
OS: Microsoft Windows 10 Home (Build 18362)
Memory: 17,129,693,184
MaxProcessMemory: 137,438,953,344
CPU: 8 Intel(R) Core(TM) i7-7700K CPU @ 4.20GHz"
PyQt version: 5.12.3
Compiled Qt version: 5.12.4
Runtime Qt version: 5.12.8

[Greg Couch]

The database behind the toolshed does not record individual votes. So to discover the bad votes, we will need to scan the web logs. Here are the existing stars and votes:

MariaDB [cxtoolshed]> select name, stars, votes from apps_app where votes > 0;
+-------------------------+-------+-------+
| name                    | stars | votes |
+-------------------------+-------+-------+
| chimeraxisolde          |    35 |     7 |
| chimeraxclipper         |     5 |     1 |
| chimeraxcytoscape       |    60 |    52 |
| chimeraxstringdb        |   103 |    54 |
| chimeraxtempy           |    60 |    43 |
| chimeraxsignalviewer    |    87 |    60 |

+-------------------------+-------+-------+

So Cytoscape, StringDB, Tempy, and SignalViewer are probably the ones that were affected by the UCSF security scanner trying every possible link.

I looked in the web logs to see if we could tell when a false rating was made. The jquery code in app_page.js is:

$.post('', {'action': 'rate', 'rating': rating}, function(data) {...});

But the arguments to the HTTP POST are not visible in the cxtoolshed ssl access log:

157.131.254.251 - - [22/May/2020:14:56:27 -0700] "POST /apps/chimeraxclipper HTTP/1.1" 200 36 "https://cxtoolshed.rbvi.ucsf.edu/apps/chimeraxclipper" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0"

Not sure if all such POSTs represent votes.

We discussed the option of just zeroing the votes for the affected bundles. That would be easier. Will spend a little more time on this before going that route.

[goddard@…]

ISOLDE and Clipper were already cleared long ago so don't change those.

For the other 4 I suggest clearing all the 1-star votes but leaving > 1-star votes if the scanning only hit 1-star as seems probable.  This does not require looking at the logs if the database has all the 1,2,3,4,5 start tallies.

[Greg Couch]

So there are 4700 entries in the logs for SignalViewer that could be votes, but only 60 votes in the database.

Conrad, Scooter, were the votes already zeroed before? And if so when?

[Greg Couch]

Tom, as noted before, the database does not have the individual tallies.

[Tom Goddard]

Tallies is not the same as individual votes. So if it does not have the totals for 1,2,3,4,5 stars (tallies), how does it compute the average rating? It knows only the total number of votes and the total number of stars?

[Greg Couch]

Yes, that is the case. It only knows the totals.

[Tom Goddard]

I got it. It was clear from your table. Just got up from a nap and my brain wasn't working! Given that ISOLDE, by far the most popular bundle has only 7 votes and I think was cleared quite a while ago, I think the total votes for other bundles is also very low and setting them to 0 is the best we can easily do and is acceptable.

[Greg Couch]

Tom, I trust you'll take care of deleting the ratings from SignalViewer? I've sent email to the Tempy contact. And Scooter should see this and decide what he wants to do.

[goddard@…]

Ok, I deleted the SignalViewer ratings.  Forgot that Tristan mentioned that that is something the bundle submitter can do.

[Greg Couch]

No response from Tempy contact. Went ahead and deleted the ratings since we know they're bogus.