If not serving the (semi-)static content (css etc and the media
items) through a dedicated webserver but using paste#static the
caching is bad.

It could easily be argued, that on a real deployment, these tings
should be served by a dedicated webserver. But still, the paste
based setups should give reasonable caching.

There are two items to consider:


1. mediagoblin/mgoblin\_static/ (CSS, ...)

Only layout/etc developers will change this and those will likely
use "reload" on their browsers anyway. Everybody else will only
change this when updating their install. So even thinking about
people updating and wanting a fresh look soon, at least an hour
would be good. I'd rather suggest a day.


2. media content (public\_store)

media items aren't **modified** currently. They get written once
and stay there as written. Creating a new media entry, creates a
new object id, etc. I'd say a week is good.

It's both hard to document and hard to follow to provide commands
where you can specify your own config file, but then you have to
specify that config file every single time for every command
afterwards.

We know people are going to write their own config files... we've
already .gitignore'd paste\_local.ini and mediagoblin\_local.ini.
When no config file is passed in, we should make it so that it
checks for and uses mediagoblin\_local.ini first and if that
doesn't exist uses mediagoblin.ini. This will allow for a simple
way for users to configure mediagoblin and be able to run commands
without accidentally running them on the wrong (non-custom) config
files, and reduce a certain amount of verbage in our docs.

media\_post\_comment blindly takes the media id from
matchdict['media'], which is just filled in from the POST URL. So
by faking up a POST URL one can add comments for non existent
media.

I *think* a simple ``get_user_media_entry`` decorator and a little
rewriting should do the trick.

Priority High: This can be used to fill the db with invisible
cruft!
Estimated Time 1.5 h: The code change is done in 10 minutes, but
testing it requires to either write test code or fiddle with yuor
browser