Alex,

In add and modify cgi's the referrers are checked after the pre hooks are done, and the control has passed to the subroutine.

Shouldn't that really be happening right after (or even before) the user authentication?

I understand that superficially it looks good to save the data, and output the bad error message on top of it, _BUT_ if the referrer is bad, they are not going to be able to use that form instance to input the data, so there is no reason to try to 'save' that data (the referrer is bad).

It's also a potential source for hacking, since they at least get a shot at the pre-hook processor before being bounced.

I know it's a small thing... but why waste the CPU, or take any risk, at all if the referrer is bad?

PUGDOG®
PUGDOG® Enterprises, Inc.
FAQ: http://postcards.com/FAQ

Hmm, I see what you are saying. Should this be a test on all user submitted cgi? And if so, should it just be one setting for all of them? Don't really want to add separate options for each form when it's a very unused feature. =)

Cheers,

Alex

--
Gossamer Threads Inc.

I would make it a global option, either check or not. If someone didn't want to check referrers for some reason, on some form, they could just comment out the call in the .cgi. But it should be done where the user validation occurs, maybe even before, since if it's a bad referrer, no reason to check or logon the user -- they'll just hit the problem the next time through the script.

The biggest problem is people trying to prevent auto submissions, so check referer on the add.cgi is probably 90% of the 5% who use it <G>

If you wanted to be cool about it, have two flags -- check_referrer_user_add
and check_referrer_user_all.

That way, you can just check submissions, or you can check the whole process.

Maybe put the referrer check as part of the User/Auth routines, since that is what it really is. But that might not work for non-register type sites.



PUGDOG®
PUGDOG® Enterprises, Inc.
FAQ: http://postcards.com/FAQ