Adsl Petition Site

anyways i have a script submitting entries if the correct meta refresh isnt working
 
Good deal! The document.location is also loads better than the meta refresh.
 
I think you would be correct, the IP addresses are te same, although jeeva could just be hosted with lusion.
 
They probably found out what this user was doing and took the corrective action on it.? Who knows?
 
slimothy said:
php has functions to handle that already, they could do $string = html_special_chars($string); or they could do $string = str_replace('<', '', $string);
Click to expand...
htmlentities() is probably a better choice than htmlspecialchars(). It escapes all html content rather than just a few characters like htmlspecialchars().
 
Unfortunately, that site and the form code was very hastily built at the last minute on Friday. We wanted to get it out there ASAP and we hadn't counted on idiots trying to mess with a cause that we all feel is important. So much for human nature -- no good deed goes unpunished.

Whatever, though. This BS won't stop us. By this afternoon, I'll have my best coder rebuild the forms, etc. It would happen sooner, but he has actual paying work to do.

Thanks for the support,
Darren
 
Signed...

If you coded them like a retard, yeah.
Click to expand...
Specifics of the loopholes?

lewstherin said:
Darren_M. I've just tested this so its definitely a bug. The petition currently allows me to put as many names as I want from the same IP address.
Surely this kind of ability should be blocked?
Click to expand...
No, unless the name is the same everytime. How else would ppl like me, working through a corporate firewall, sending out a single IP address to the world, be able to sign, along with all my colleagues?
 
Last edited:
This does not take into account that multiple people may reside at the same location and use a communal internet connection, nor does it cater for dynamic addresses very well.

Rather just ensure each entry is a unique name, after all it’s not feasible to try verifying all the names anyway so there is no point in limiting the submissions.

I expect the list will be pruned of obviously bogus entries and that’s about the best we can hope for.
 
ettubrute said:
Specifics of the loopholes?
...
No, unless the name is the same everytime. How else would ppl like me, working through a corporate firewall, sending out a single IP address to the world, be able to sign, along with all my colleagues?
Click to expand...

Well, they could simply check the X-Forwarded-For header appended by pretty much all proxies. You have a point though if you're on NAT.

Specifics of loopholes, well essentialy web programming ethos should be such that "never trust user input". Doesn't matter what you are building, who is using it, or what "human nature" is like - you shouldn't write flakey software. Imaginet have my sympathies though - given who was doing the spamming, it is a little sad.
 
pookfuzz said:
I expect the list will be pruned of obviously bogus entries and that’s about the best we can hope for.
Click to expand...

Yep, it already has been pruned and we'll make sure it's nice and clean before we print it out and present it to government, etc.
 
darren I assume you're from imaginet and I know you're going to lock down the code now but if I may make a tiny suggestion... set a cookie on the users machien and store the IP in the database and use a timestamp associated with the IP as well as the cookie to prevent multiple signing because it holds little credibility if anyone can just make up a hundred names and sign the petition.

Also regexp is your friend
 
slimothy said:
darren I assume you're from imaginet and I know you're going to lock down the code now but if I may make a tiny suggestion... set a cookie on the users machien and store the IP in the database and use a timestamp associated with the IP as well as the cookie to prevent multiple signing because it holds little credibility if anyone can just make up a hundred names and sign the petition.

Also regexp is your friend
Click to expand...

LOL @ regexp... it's not *my* friend, that's for sure. hehe

Thanks to all for the suggestions. I'll pass them on to my coder.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X