Gossamer Forum
Quote Reply
linkdead
i've just had someone using some sort of script or something to send tons of random junk mail to me via the linkdead2.cgi script

ie:
Code:

#!/usr/local/bin/perl
# -------------
# Links
# -------------
# Links Manager
#
# File: linkdead.cgi
# Notifies the webmaster of a deadlink
# Author: Glenn Utteridge
# Based on and designed to be used with
#Links 2 by: Alex Krohn
# Email: alex@gossamer-threads.com
# Web: http://www.gossamer-threads.com/
# Version: 2.0
#
# (c) 1998 Gossamer Threads Inc.
#
# This script is not freeware! Please read the README for full details
# on registration and terms of use.
# =====================================================================
#
#
# Setup:
# Make sure the require statement below points to the config file.
eval {
($0 =~ m,(.*)/[^/]+,) && unshift (@INC, "$1"); # Get the script location: UNIX /
($0 =~ m,(.*)\\[^\\]+,) && unshift (@INC, "$1"); # Get the script location: Windows \
require "admin/links.cfg"; # Change this to full path to links.cfg if you have problems.
require "$db_lib_path/db_utils.pl";
require "$db_lib_path/links.def";
$build_use_templates ?
require "$db_lib_path/site_html_templates.pl" :
require "$db_lib_path/site_html.pl";
};
if ($@) {
print "Content-type: text/plain\n\n";
print "Error including libraries: $@\n[/url]";
print "Make sure they exist, permissions are set properly, and paths are set correctly.";
exit;
}
# ========================================================
eval { &main; }; # Trap any fatal errors so the program hopefully
if ($@) { &cgierr("fatal error: $@"); } # never produces that nasty 500 server error page.
exit; # There are only two exit calls in the script, here and in in &cgierr.
sub main {
#-------------------------------------------------------------------
# Main Routine

# Sends an email to the admin, letting him know that there is a dead link.
my %in = &parse_form();
# Check to make sure that there is an admin email address defined.
$db_admin_email or &cgierr("Admin Email Address Not Defined in config file!");
my $to = $db_admin_email;
my $from = $in{'From'};
my $subject = "Deadlink ID number: $in{'ID'}\n";
my $msg = qq|
The following link is reported to be dead:
ID number: $in{'ID'}
Site title: $in{'Title'}

Site URL: $in{'URL'}
Category: $in{'Category'}
Description: $in{'Description'}
Comment: $in{'Comment'}

|;
# Then mail it away!
require "$db_lib_path/Mailer.pm";
my $mailer = new Mailer ( { smtp => $db_smtp_server,
sendmail => $db_mail_path,
from => $from,
subject => $subject,
to => $to,
msg => $msg,
log => $db_mailer_log
} ) or return;
$mailer->send or return;
&site_html_deadlink_mail;
}





since they are going directly to linkdead2 and not via linkdead i'm having trouble adding the referer script:

Code:

# Check Referers
@db_referers = ('site.com','www.site.com');
if (@db_referers) {
$found = 0;
foreach (@db_referers) {
$ENV{'HTTP_REFERER'} =~ /$_/i and $found++ and last;
}
if (!$found) {
&site_html_add_failure ("Please don't try to spam the directory with deadlink submissions");
return;
}
}




Any idea how i can get it working so it checks the referer first?
Or preferably since that can be spoofed - how about ensuring that the 'ID' is a number (since they seem to be fooling the script into sending the subject of the email via the "ID" code)?



thanks

Last edited by:

bs7: Feb 10, 2006, 5:14 PM
Quote Reply
Re: [bs7] linkdead In reply to
Try this:

# Sends an email to the admin, letting him know that there is a dead link.
my %in;

$in{'real'} ? &parse_form() : print "Please use the correct form."
and return;

Then in your form to submit a deadlink, add this before the </form> tag:

<input type="hidden" name="real" value="real">

This will make the script not work unless it has the input from the hidden field.
I did not test this...


Leonard
aka PerlFlunkie
Quote Reply
Re: [PerlFlunkie] linkdead In reply to
thanks so much for helping.

i've had some slight problem with that code though:

"malformed header from script. Bad header=Please use the correct form.: /cgi-bin/linkdead2.cgi"

any ideas?

again - thanks
Quote Reply
Re: [bs7] linkdead In reply to
Yeah, that 'print' part is not sending anything except the text, which is bad form. You could set it up to create headers, etc, or you could create a report_error template, add a routine to site_html_templates, then call &site_html_report_error.

If you need more details, let me know. Don't have time right now, but can explain better if required.

=======
Actually, took a quick look at the mod, there is an error page, so replace the print "blah" part with &site_html_report_failure_form ("Please use the form.")


Leonard
aka PerlFlunkie

Last edited by:

PerlFlunkie: Feb 11, 2006, 11:35 AM
Quote Reply
Re: [PerlFlunkie] linkdead In reply to
thanks a million!!


i didn't have "site_html_report_failure_form" - so got a "fatal error" but "site_html_deadlink_error" works fine - thanks

the only slight problem is that the error is being triggered everytime - even from the page with the hidden "real" field. Any ideas how to tweak that too?




(unbelievably the same person has been attempting to submit junk emails to me via the form several times each hour (despite the 404 error) - they are using anonymous proxies - so there are too many IPs to ban and they're spoofing the referer for the page too)


Thanks again
Quote Reply
Re: [bs7] linkdead In reply to
You must be using a different report script than I have on file.

Here is one way...

sub main {
#-------------------------------------------------------------------
# Main Routine

# Sends an email to the admin, letting him know that there is a dead link.
my %in = &parse_form();

$in{'real'} ? &report : &site_html_deadlink_error ("Please use the form.") and return;
}

sub report {
#-------------------------------------------------------------------
# Check to make sure that there is an admin email address defined.


...etc...

Of course, you could always just re-name the cgi script, and the link to it in your link.html template. Then your spammer would get nothing but a 404 (or maybe a 500) error.


Leonard
aka PerlFlunkie
Quote Reply
Re: [PerlFlunkie] linkdead In reply to
thanks again.


For some reason

"$in{'real'} ? &report : &site_html_deadlink_error ("Please use the form.") and return;
}

sub report { "

is stopping the rest of the submittal working properly - i.e. it blocks the junk perfectly and it sends the email but isn't passing on the info - the url, id, etc all come back blank.


Don't worry about it though - my sites so small no one ever uses the deadlink function anyway - so i'll just delete it (it amazes me that anyone would even go to the trouble of sending junk to it).


Thanks again for your help