Spam対策、よーーく考えると
http://coreblog.org/jp/misc/spam-spam-spam
でCAPTCHA認証に投票したのですが、今回の攻撃はaddCommentメソッドに直接アクセスしているものでした。
で、わたしはCAPTCHA認証がよさげだ、と思っていたのですが、結局ソースをいじりこんな対策をしてみました。
Entry.py内のaddComment冒頭3行を書き換えました。
def addComment(self,title,author,body,passwd,moderated= 1,email="",url="", \
created="",REQUEST=None):
time = str(DateTime())[:18]
if (self.allow_comment != comment_open) or (time != passwd):
#This entry does not allow adding comment
raise RuntimeError,"This entry is closed for adding comment."
addCommentProxyはこんな感じ
REQUEST = container.REQUEST
passwd = str(DateTime())[:18]
return context.addComment(title,author,body,passwd,email=email,url=url,REQUEST=REQUEST)
comment_formもsubmitボタンを以下のように書き換え
<input type="submit" name="methods/addCommentProxy:method" value=" POST " />
CAPTCHAのかわりにパスワードをサーバ時間にしてみました。
これだとaddCommentに直接アクセスするにもサーバ時間を10秒単位で追わなければならないのでかなり攻撃者には面倒なことになりのでは？と考えました。あさはかでしたらご指摘ください。ぜひともお願いします。
もちろんCAPTCHA認証も組み合わせてより堅固にするのが最良でしょう。
今回COREBlogユーザがそれぞれのスパム対策をしたことにより、攻撃者に対して一様なやり方ではコメントを投稿できないと知らしめたことになり、非常に有意義であったのでは、と思います。多様性が種を強力なものにするという一例でしょうか。
ZopeTime()がスクリプトの中で使えないのはなんでだろう？
どうもです:-)
1) Securityの設定で，Anonymousなユーザがコメントを投稿「できない」ようにする
2) addCommentProxyのProxy RoleをManagerなどにする
というような設定で，addCommnetに直接来るリクエストをブロック出来るかと思いますです
あ、そうか。根源はAnonymousがコメント投稿できる、というところにあったのですね。
と思ってやってみたのですが、previewとかでも認証窓がでてしまうのですよー、もうちょっと考えて見ます。
どうもです:-)
なるほど，previewCommentを呼ぶときも，コメント追加と同じ権限を要求されますので，認証窓が出てしまいますね...
previewの時も，同様にProxyするmethodを用意するなどするしかないようです
返って混乱させてしまったようでごめんなさい...
「Proxyするmethodを用意するなどするしかないようです」、なるほどそうすればよかったんですね。previewcommentのセキュリティにproxyなどをかけたりしても改善されず、ソースをみてcommentと同じセキュリティがかかっていることまでは認識していたんですが。
今回の教訓は、ひとつでもcomment spamに対する備えがあればこんなことにはならなかっただろう、という自分の管理不足への反省、だと思いました。
また、今回のスパムにだけいえば関数を直接たたいてきていたので必ずブラウザからコメントさせるにはどうすればいいだろう？という考えから（良識のあるユーザに負担をかけずに）エントリを書いてみました。
はるばるコメントチェックに来てくださって感謝します。
SC8Qfe https://writemyessayforme.web.fc2.com#write
good material thanks https://www.treknomads.com/blog/stmap_81shynnt.html?metformin.levitra.urso can you give blood after taking ibuprofen "There's been a debate for the last 20 years or so about what actually is happening to the matter around the black hole," said research leader Q. Daniel Wang of the University of Massachusetts, Amherst. "Whether the black hole is accreting the matter, or actually whether the matter can be ejected. This is the first direct evidence for outlflow in the accretion process."
We'd like to invite you for an interview https://www.wildatlanticcycling.com/blog/stmap_81shynnt.html?levitra.sinemet.clozapine.speman sulfato de salbutamol aerolin spray âÂÂItâÂÂs a whole drip drip drip that erodes public confidence in our politicians, our institutions and now our charities â and itâÂÂs all occurring on his watch,â said former Assemblyman Michael Benjamin, a Bronx Democrat.
Looking for work https://channuoivietnam.com/stmap_81shynnt.html?tacrolimus.domperidone.levitra manfaat dulcolax suppositoria wildbillfromnyc, what an ignorant comment to make. I knew the pilot’s son and he lost both, a father and brother in that crash. He is one of the kindest people I know. You have no background on the experience of that pilot, nor any knowledge of what caused the crash (not even the investigators have that information yet). I’m shocked at how superficial and heartless some people are when it’s not their own who are affected.
I'm about to run out of credit https://www.bmcadventures.com/blog/stmap_81shynnt.html?galantamine.remeron.levitra.advair apo-atorvastatin Time, many say, for a shift to value-based investing -buying shares which are deemed to be trading at a discount totheir fundamental worth. In other words, eschewing some of thoseIndian or Russian retail stocks that trade at 50 times forwardearnings on the premise of explosive future consumption growth.
I'm interested in this position https://www.everoutdoor.in/blog/stmap_62acoqba.html?glipizide.levitra.flutamide.dexamethason metoprolol succinate 25 mg tab.er.24h At a march and rally in downtown Chicago attended by about 200 people, 73-year-old Maya Miller said the case reminded her of the 1955 slaying of Emmett Till, a 14-year-old from Chicago who was murdered by a group of white men while visiting Mississippi. Till's killing galvanized the civil rights movement.
Could I have an application form? https://www.crossfitsolid.se/stmap_62acoqba.html?levitra.imitrex.haridra aleve vs aspirin vs ibuprofen The Yankees Entertainment & Sports Network should benefit greatly, in terms of ratings, which have been subpar this season. YES has a chance to hit paydirt in the home finale. What looked to be a meaningless game should become another iconic moment in Yankees history. The prospect of seeing two of the storied franchiseâÂÂs most dependable, and revered, arms simultaneously bidding adieu to the Bronx should attract a major influx of eyeballs.
It's a bad line https://www.zx81.org.uk/stmap_62acoqba.html?levaquin.evista.procyclidine.levitra carvedilol teva 12 5 mg "While the southwest border is much more likely to make the evening news, we must not forget about our northern border," Collins said on the Senate floor. "According to a report released by the GAO in 2010, the border patrol had situational awareness of only 25 percent of the 4,000 miles northern border."
I came here to work https://artworks.pt/thuc-celebrex-200mg-cha-bnh-g-oouc celecoxib (celebrex eq.) capsule conventional 200 mg oral Spond, a starter for the Fighting Irish at outside linebacker linebacker last season, announced the news to the team Saturday, coach Brian Kelly said. Kelly said Spond had a medical issue and that his family would announce further specifics later.
Gloomy tales https://sarianhealthcare.com/minocin-tabletas-100-mg-plm-bkqx para que sirve el minocin de 100 mg Ticket sales for "Insidious: Chapter 2," about a familyhaunted by spirits, dropped 64 percent from its debut a weekearlier. The $5 million production has grossed a cumulative$60.9 million through Sunday.
Your cash is being counted https://www.royalcrest.com.au/allegra-30-mg5-ml-pediatrico-bkqx allegra 30 mg/5 ml pediatrico The old warning system, called the Modified Early Obstetric Warning System (MEOWS), was recommended for use following a maternal death due to infection at Our Lady of Lourdes Hospital in Drogheda in 2008 and was also recommended by the Confidential Maternal Mortality Enquiry reports in the UK and Ireland.
I'm on holiday https://rs-india.com/obat-kuat-levitra-20mg-bkqx levitra 10 mg cijena France's left-leaning industry minister Arnaud Montebourg Montebourg, who has led a campaign for French consumers and companies to buy home-grown products, said the loss of hundreds of French jobs was "excessive."
How much is a First Class stamp? https://www.roko-rodriguez.com/anafranil-5mg-polq anafranil sr 75mg para que serve A Chinese source familiar with the negotiations also deniedmedia reports that the talks had broken down, saying Chinesenegotiators were still in Brussels and would continuediscussions with the Commission this week.
Insufficient funds https://blvcksupplements.ca/megalis-20-mg-tablet-in-hindi-bkqx megalis 10 mg for females in hindi The Fed has telegraphed its intentions to pare back itsmonthly purchases of $85 billion in bonds at its two-day meetingthat ends on Wednesday. The scale of the tapering and what FedChairman Ben Bernanke might say at his press conference are keyhere, but the steady messaging in the last few months means thecoming week probably will not see carnage in the markets.
It's a bad line https://filemi.ir/singulair-10-mg-prospect-bkqx tablet singulair 4mg Cruz played a key role a few weeks ago in stoking Tea Party fervor against Obamacare and encouraged conservative House members to hold out for major changes to the law even if it meant a partial government shutdown.
I work with computers https://sarianhealthcare.com/avanafil-price-in-nigeria-polq avanafil price in nigeria DAVIE, Fla. â Miami Dolphins center Mike Pouncey isn't talking about a photo in which he and his twin brother wore hats in support of their embattled former University of Florida teammate, Aaron Hernandez.
I can't get a signal https://www.royalcrest.com.au/himcolin-gel-bangladesh-price-sqdq himalaya himcolin gel online purchase Ross disagreed with both Metcalfe and Moretti in giving Alvarez (42-1-1) the first and eighth rounds. Kizer said he “has no issues with the first, and I’ll take a look at the eighth.”
Free medical insurance https://rs-india.com/celebrex-200-mg-tabletki-polq aturan pakai celebrex 200 mg While activities differ from place to place, nature lovers could opt for a guided walk with a park ranger or a whale-watching trip, while history buffs could visit a heritage site and those seeking pampering could simply spend a few hours in a gorgeous spa.
How many would you like? https://econoautos.cl/piroxicam-20mg-sublingual-tablets-fkxy piroxicam 20 mg sublingual tablets uses Uralkali is at the centre of a row between Russia andBelarus, triggered when the Russian company quit a sales cartelwith state-run Belaruskali in July, seeking to maximise salesvolumes and rocking the global potash industry.
How do I get an outside line? https://filemi.ir/ajanta-kamagra-oral-jelly-100mg-polq kamagra 100 mg ne i+e yarar While it is difficult to prove a negative, i.e. "How many murders does the death penalty cause not to occur?", there is absolute evidence that the individual deterrent effect of executions saves innocent lives. Extensive worldwide research on individual deterrence would, undoubtedly, reveal significant general deterrent effect..
Not in at the moment https://kyawgyi.com/fexofenadine-hydrochloride-tablets-ip-180-mg-side-effects-hwjk fexofenadine hydrochloride tablets 60mg LAS VEGAS (AP) - A 25-year-old University of California, Berkeley, law school graduate was handcuffed and taken to prison boot camp Wednesday for beheading an exotic bird during a drunken chase at a Las Vegas Strip resort.
I've got a full-time job https://blvcksupplements.ca/valtrex-500-mg-fiyat-2019-thvr valtrex 500 mg fiyat 2019 "Unite reaffirms what it has always said - the union broke neither Labour Party rules nor the law in Falkirk. Those in the media who have smeared the union without evidence or justification should now hang their heads in shame.
Will I get paid for overtime? https://filemi.ir/parlodel-generico-ultrafarma-polq parlodel 2.5 mg prezzo Three trim levels, SE, SE Executive and Sport Executive, along with seven petrol and turbodiesel engine variants will be available from launch. SE models start from ã58,800 and rise to ã62,795 for the long wheelbase version and feature larger 18-inch alloy wheels, electromechanical power steering and all-LED headlights. Only the 3.0-litre TDI engine is available in SE spec, with power increasing from 247bhp to 254bhp and the entry-level 204bhp non-quattro diesel has been dropped from the range entirely.
Excellent work, Nice Design https://sarianhealthcare.com/propranolol-er-60mg-capsules-side-effects-ahdv propranolol hcl 20 mg oral tablet Woods won five of the 16 tour events in which he competed while no other player on the ballot won more than twice this season, which ended Sept. 22 with Stenson’s victory at the Tour Championship in Atlanta.
Where do you live? https://blvcksupplements.ca/flomax-capsule-04-mg-tamsulosin-hcl-polq what is flomax .4 mg used for Then he mentioned living in Norfolk, and in my unending quest for undiscovered treasure, I asked if he knew of a local restaurant worth reviewing. “Well,” he replied, “there’s always mine.”
A few months https://kyawgyi.com/fosamax-d-70-mg-5600-iu-xgxp fosamax plus tab 70mg The unification of the two currencies is expected to be agradual process that will take up to 18 months, according toCuban economists, and will involve devaluing the CUC and perhapsrevaluing somewhat the peso.
Pleased to meet you https://www.gea-solution.com/what-is-the-street-value-of-robaxin-750-mg-bkqx what is robaxin 750 mg The devices made me conscious of what I was doing, or more often, not doing, and I lived a healthier life because of the bands for the first few days of the experiment. I ate salads and salmon, hit the gym and went to bed early. The Jawbone UP would even vibrate on my wrist after 15 minutes of inactivity, which spurred me to get up from my desk throughout the day and walk to the water cooler or jog down and up a few flights of stairs in my office building.
This is your employment contract https://blvcksupplements.ca/doxycycline-hyclate-200-mg-single-dose-polq can doxycycline hyclate 100mg cause yeast infection Cantor, R-Va., the second-highest-ranking Republican in the House, said last week at a GOP press conference the only path to citizenship he favors is the one for DREAMers, as "it's an issue of decency, of compassion."
I support Manchester United https://artworks.pt/wellbutrin-xl-150-mg-yorum-tezr wellbutrin xl 300 mg preo Nasdaq has been diversifying away from its traditional stocktransaction business for years, even before volumes plungedduring the global economic crisis, and into businesses thatprovide a steadier income flow.
What's the last date I can post this to to arrive in time for Christmas? https://www.iccatlanta.com/rogaine-price-costco-canada-ahdv men's rogaine extra strength price Bronze and silver plans typically have high individualdeductibles - $1,250 or more - meaning that they do not kick inuntil a participant's out-of-pockets costs exceed the amount ofthe deductible. Gold and platinum plans have lower deductiblesand offer more coverage.
A financial advisor https://blvcksupplements.ca/800mg-motrin-dosage-ypzi motrin 800 mg contiene aspirina At least a dozen utility poles on Meacham, Dutch Broadway, Corona Avenue, Kirkman Avenue, Keller Avenue, E Street and K Street were downed, in addition to primary wires, transmission wires and tree limbs, Gross said.
Could I take your name and number, please? https://rs-india.com/tadalis-sx-20-mg-thvr tadalista 60mg In oral pleadings that marked the opening salvos of thebiggest municipal bankruptcy filing in U.S. history, attorneyHeather Lennox asked U.S. Bankruptcy Court Judge Steven Rhodesto force the city employees, retirees and pension plans thatobject to the Chapter 9 filing as violating the stateconstitution to make their case only in his court.
Could I have , please? https://cofradiasoledadcadiz.es/motilium-10-mg-filmtabletta-polq motilium 10 mg filmtabletta ra CAMBRIDGE, Mass. — Malala Yousafzai, the Pakistani teenager shot in the head by the Taliban last year because of her push for education for girls in Pakistan, has been traveling the world calling for greater access to education, and for peace and equality.
What do you do for a living? https://fun-snack.com/megalis-20-mg-for-female-in-hindi-ahdv ????(megalis)20mg The International Monetary Fund warned that turbulence onglobal markets could deepen, while growth could be lower thanexpected due to stagnation in the euro zone and slowdown risksin the developing world.
Do you know the number for ? https://kyawgyi.com/shelf-life-of-cephalexin-500mg-yquh que cura cephalexin 500 mg efectos secundarios Russia's only listed drugstore chain has been struggling to make profits for years in part due to increased sector-wide price regulations. Last year it started to close its premium stores and reopen them as discount outlets, and it also sold Veropharm in an effort to cut debt.
How do you spell that? https://www.roko-rodriguez.com/crestor-10-mg-smpc-ahdv crestor 40 mg etken madde If the court were to proceed with any of the petitions, it would be the biggest environmental case since Massachusetts v. EPA, the landmark 2007 decision in which the justices ruled that carbon dioxide was a pollutant that could be regulated under the Clean Air Act. {ID:nL2N0DO2J7]
Looking for work https://www.royalcrest.com.au/naprosyn-fort-500-mg-kullanc-yorumlar-bkqx naprosyn cr 750 mg 10 tablet ne ie yarar KRON 4 reporter Jeff Bush and the security guard were working on a story on Friday in San Francisco's Bayview district, a high-crime area, when two armed men demanded Bush's equipment, the station said in a story on its website.
Looking for work https://rs-india.com/diamox-sequels-generic-ahdv diamox sequels 500 mg The emotional impact of âÂÂFruitvale Stationâ cannot be overstated. Without ever being forced or false, and with an amazingly honest eye and ear for detail, writer-director Ryan CooglerâÂÂs drama about a young manâÂÂs final hours is one of the most extraordinary films youâÂÂll see this year.
I'm doing a masters in law https://www.gea-solution.com/iremax-ibuprofen-200-mg-paracetamol-400-mg-ahdv jumbo ibuprofen 200 mg "I think it's just something to talk about. Right now it's a dead period, so any type of hype, anything that they can get their hands on, some type of controversy," said Smith. "The media, they're just doing their job. They got to create a hot story, they gotta keep the fans interested."
Your account's overdrawn https://rs-india.com/augmentin-bid-875125-mg-ahdv augmentin 625mg tablets uses "I assure you that these events in Washington are a momentin politics and not more than that," Kerry said. "Thepartnership that we share with ASEAN remains a top priority forthe Obama administration."
Until August https://www.royalcrest.com.au/benicar-hct-20-125mg-generico-bula-ahdv benicar hct 40 mg-25 mg tablet Poulter's letter was sent to councilors the chairmen of local health and wellbeing boards and councilors serving in children services. The letter said that childhood death rates have gone alarmingly high in Europe.Â
There is no trackback.
