Hi, You need to take steps to prevent malicious scripting- currently various forms of
<form id="editform" name="editform" method="post" action=" http://en.wikipedia.org/w/index.php?title=Wikipedia:Sandbox&action=submit " enctype="multipart/form-data"> <input type='hidden' value="" name="wpSection" /> <input type='hidden' value="20000101010101" name="wpStarttime" /> <input type='hidden' value="20051216225758" name="wpEdittime" /> <input type='hidden' value="" name="wpScrolltop" id="wpScrolltop" /> <input type='hidden' value="SPAM" name="wpTextbox1" id="wpTextbox1"> <input tabindex='2' type='hidden' value="" name='wpSummary' id='wpSummary'/> <input tabindex='5' id='wpSave' type='submit' value="Save page" name="wpSave" accesskey="s" title="Save your changes [alt-s]"/> </form>
That runs locally and uses basic javascript to change the 'wpEdittime' var to a few seconds before current time could be used to coordinate disruptive attacks. I know that it is a simple matter to fix entries, but it is a simpler matter to stick a if(getenv("HTTP_REFERER")='207.142.131.202'){}else{//fail handler} or similar line in the submit function.
Tom Markle wrote:
You need to take steps to prevent malicious scripting- currently various forms of
[snip]
That runs locally and uses basic javascript to change the 'wpEdittime' var to a few seconds before current time could be used to coordinate disruptive attacks.
Client-side code is, naturally, not under our control, so there's not anything to "prevent".
If you're referring to offsite form submissions automated with JavaScript, we already have protection in place to prevent this for registered users. At most it would be an annoyance for unregistered accounts as there's no security issue -- you can already submit edits as an unregistered visitor.
Since the protection requires maintaining session state, requiring it for anonymous editors would also cut out users who don't accept cookies.
I know that it is a simple matter to fix entries, but it is a simpler matter to stick a if(getenv("HTTP_REFERER")='207.142.131.202'){}else{//fail handler} or similar line in the submit function.
Referrers are utterly unreliable: first, the client can always falsify them. Second, requiring it will cut out anyone using a privacy proxy.
-- brion vibber (brion @ pobox.com)
wikitech-l@lists.wikimedia.org