[Typo3-dev] security suggestion for tipafriend ext

[Chi Hoang]

Dear Kasper, hello Developer,

to prevent spaming the tipafriend ext I reduced the max. tips to 4 per
session. What do you think? Good approach? Maybe I time would be better? Is
using session acceptable? Is it more safe then before?

In class.tx_tipafriend.php in function main_tipafriend($content,$conf) I
added this lines at the beginning:

session_start();

if(!isset($_SESSION["tips"])) {
   $_SESSION["tips"]=0;
} else {
   $_SESSION["tips"]+=1;
}

then in function tipform() in the same class I changed

 if (t3lib_div::_GP('sendTip')) {
   if ($this->validate($tipData)) {
     $this->sendTip($tipData,$url);
     $sent=1;
   } else {
    $error=1;
   }
  }

to this:

if (t3lib_div::_GP('sendTip')) {
   if ($this->validate($tipData)) {
         if ($_SESSION["tips"] < 5) {
            $this->sendTip($tipData,$url);
            $sent=1;
         } else {
            $error=1;
         }
   } else {
    $error=1;
   }
}

Greets,

Chi