[ php-blog-Bugs-1918786 ] Wrong generation of Karma voting links

Bugs item #1918786, was opened at 2008-03-18 21:25
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Simone Tellini (tellini)
Assigned to: Nobody/Anonymous (nobody)
Summary: Wrong generation of Karma voting links

Initial Comment:
After upgrading to 1.3, I've decided to try the improved karma plugin. As soon as I've enabled it, my logs started to fill with suspicious links like:

[18/Mar/2008:13:55:39 -0700] "GET /blog/index.php?&serendipity[karmaVo
te]=1&serendipity[karmaId]=50&serendipity[karmaVote]=ht
tp%3A%2F%2Fwww.destinationthesun.info%2Fcapeverde%2Fform%2Fuse%2Fsampleform%2Fadmin%2Fitixahe%2Frilika%2F&a
mp;amp;amp;amp;serendipity[karmaId]=48&serendipity[karmaVote]=-2&se
rendipity[karmaId]=50&serendipity[karmaVote]=-2&serendipity[karmaId]=51&amp
;amp;amp;amp;amp;serendipity[karmaVote]=-2&serendipity[karmaId]=52&serendipity[karmaVot
e]=2&serendipity[karmaId]=46&serendipity[karmaVote]=-2&serendipity[karmaId]=45&
amp;serendipity[karmaVote]=1&serendipity[karmaId]=52&serendipity[karmaVote]=1&serendipity[karmaId]=46 HTTP/
1.0" 200 106464 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"


Apart from the fact that the undesired URL (www.destinationthesun.info) doesn't appear to cause much damage, I think that the URL generation could be improved.

In fact, even when someone is not trying to exploit the plugin, after you vote you can find URLs like the following one in the page:

/blog/index.php?&serendipity[karmaVote]=2&serendipity[karmaId]=50&serendipity[karmaVote]=2&serendipity[karmaId]=43#karma_vote43

There seem to be a bit of confusion in the query string ;-)

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2008-03-18 21:49

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thank you for reporting this. Even though many people tested the karma
plugin, this error has not yet surfaced.

First off, what is the URL to your Blog? It looks like this URL is picked
up from somewhere, and misconfigured permalinks MIGHt be a possible
explaination. Did you change anything in your permalink configuration of
the s9y blog?

Regards,
Garvin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/