Wed, 15 Mar 2006

Comment Form Attack

Came back from a nice walk on the seafront, including a 30 minute professional firework display from a boat 20 meters offshore and about 50 people watching, to find that someone had attempted to attack my blog comment to send spam. Fortunately according to my mail logs, nothing went out, but it did make me go through and read the comment plugin code. I did wonder if every suitable field had been cleaned and have now made sure that it is. Looks like it came from several IP addresses over a 5 minute period and got past my (admittedly very) simple turing test, so I don't think it was an automated script. For an example of the attacks, check out this old posting.

[] | # Read Comments (2) |

Comments

Testing comments
Posted by JD at Wed Mar 15 00:05:19 2006
We had problems with injected SMTP commands and the comments plugin a while ago (I think it was over a year ago) and Ted fixed it so that if the comments plugin is configured to send comments via SMTP to you as a notification, it won't "accidentally" go and send a bunch of comment spam through your MTA as well.

While I haven't tested this fix in a while, I'm pretty sure it still works.

Anyhow, my point being that if you do find any issues, let me know.

Thanks!
/will
Posted by will at Wed Mar 15 15:11:53 2006

Name:


E-mail:


URL:


Comment:


Please enter "fudge" to prove you are a human