[Typo3-dev] security suggestion for tipafriend ext

[Kasper Skårhøj]

I don't think the session thing here improves anything - after all a
spammer wouldn't accept cookies and thus no sessions...

Anyways, I'm aware that tip-a-friend is a big big spam-hole, but I'm not
really able to find time for it. I think it is already in CVS so others
could take over maintenance and find a good solution. I will not find
the time for it.

- kasper

On Tue, 2004-06-08 at 16:26, Chi Hoang wrote:
> Dear Kasper, hello Developer,
> 
> to prevent spaming the tipafriend ext I reduced the max. tips to 4 per
> session. What do you think? Good approach? Maybe I time would be better? Is
> using session acceptable? Is it more safe then before?
> 
> In class.tx_tipafriend.php in function main_tipafriend($content,$conf) I
> added this lines at the beginning:
> 
> session_start();
> 
> if(!isset($_SESSION["tips"])) {
>    $_SESSION["tips"]=0;
> } else {
>    $_SESSION["tips"]+=1;
> }
> 
> then in function tipform() in the same class I changed
> 
>  if (t3lib_div::_GP('sendTip')) {
>    if ($this->validate($tipData)) {
>      $this->sendTip($tipData,$url);
>      $sent=1;
>    } else {
>     $error=1;
>    }
>   }
> 
> to this:
> 
> if (t3lib_div::_GP('sendTip')) {
>    if ($this->validate($tipData)) {
>          if ($_SESSION["tips"] < 5) {
>             $this->sendTip($tipData,$url);
>             $sent=1;
>          } else {
>             $error=1;
>          }
>    } else {
>     $error=1;
>    }
> }
> 
> Greets,
> 
> Chi
> 
> 
> _______________________________________________
> Typo3-dev mailing list
> Typo3-dev at lists.netfielders.de
> http://lists.netfielders.de/cgi-bin/mailman/listinfo/typo3-dev
-- 


- kasper
--------------------
"Waiting for typo3.org..."