Re: OK, .. this one's a stumper.

[Casey Boone <caseyboone@gmail.com>]

how about this, set up server side such that when the page containing
the form is requested, the requesting ip is added to a
list/database/whatever and when the script that processes the form is
called, check the list.  also limit the number of requests per ip
(assuming it passes being on the list)

also you could put some kind of session information into the form page
that gets submitted along with everything else, and your form processor
checks that the session info matches what it would expect (again using a
list/db/whatever)

HTH

Casey


L. V. Lammert wrote:
> Everyone knows mailer scripts are a security hole, .. historically,
> they are restricted by referer URL & recipient address patterns.
> Recipient works pretty well, as the only allowed output email address
> can be tightly controlled.
>
> Unfortunately, it seems like there some of the script kiddies have
> found ways to get around the referer URL - i.e. By posting the form
> directly to the form mailer, they are apparently also forging the
> environment variables to satisfy the referer check. I tried changing
> from referer URL to matching the server address, .. but it DNW either.
> (Obviously, the first action was to delete the calling document so it
> cannot be invoked in any form on the server.)
>
> Is anyone aware of a more secure way to valdate the source document
> other than referer URL or server address? Or is there a way to secure
> the mailer itself (callable from a number of domains)?
>
>     Thanks!
>
>     Lee
>
>
> -
> To unsubscribe, send email to majordomo@silug.org with
> "unsubscribe silug-discuss" in the body.
>

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.