[ php-blog-Bugs-1918786 ] Wrong generation of Karma voting links

Bugs item #1918786, was opened at 2008-03-18 22:25
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Simone Tellini (tellini)
Assigned to: Nobody/Anonymous (nobody)
Summary: Wrong generation of Karma voting links

Initial Comment:
After upgrading to 1.3, I've decided to try the improved karma plugin. As soon as I've enabled it, my logs started to fill with suspicious links like:

[18/Mar/2008:13:55:39 -0700] "GET /blog/index.php?&serendipity[karmaVo
te]=1&serendipity[karmaId]=50&serendipity[karmaVote]=ht
tp%3A%2F%2Fwww.destinationthesun.info%2Fcapeverde%2Fform%2Fuse%2Fsampleform%2Fadmin%2Fitixahe%2Frilika%2F&a
mp;amp;amp;amp;serendipity[karmaId]=48&serendipity[karmaVote]=-2&se
rendipity[karmaId]=50&serendipity[karmaVote]=-2&serendipity[karmaId]=51&amp
;amp;amp;amp;amp;serendipity[karmaVote]=-2&serendipity[karmaId]=52&serendipity[karmaVot
e]=2&serendipity[karmaId]=46&serendipity[karmaVote]=-2&serendipity[karmaId]=45&
amp;serendipity[karmaVote]=1&serendipity[karmaId]=52&serendipity[karmaVote]=1&serendipity[karmaId]=46 HTTP/
1.0" 200 106464 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"


Apart from the fact that the undesired URL (www.destinationthesun.info) doesn't appear to cause much damage, I think that the URL generation could be improved.

In fact, even when someone is not trying to exploit the plugin, after you vote you can find URLs like the following one in the page:

/blog/index.php?&serendipity[karmaVote]=2&serendipity[karmaId]=50&serendipity[karmaVote]=2&serendipity[karmaId]=43#karma_vote43

There seem to be a bit of confusion in the query string ;-)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/