[ php-blog-Bugs-1918786 ] Wrong generation of Karma voting links

Bugs item #1918786, was opened at 2008-03-18 17:25
Message generated for change (Settings changed) made by slothman
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
Status: Open
Resolution: None
>Priority: 7
Private: No
Submitted By: Simone Tellini (tellini)
>Assigned to: Jude Anthony (slothman)
Summary: Wrong generation of Karma voting links

Initial Comment:
After upgrading to 1.3, I've decided to try the improved karma plugin. As soon as I've enabled it, my logs started to fill with suspicious links like:

[18/Mar/2008:13:55:39 -0700] "GET /blog/index.php?&serendipity[karmaVo
te]=1&serendipity[karmaId]=50&serendipity[karmaVote]=ht
tp%3A%2F%2Fwww.destinationthesun.info%2Fcapeverde%2Fform%2Fuse%2Fsampleform%2Fadmin%2Fitixahe%2Frilika%2F&a
mp;amp;amp;amp;serendipity[karmaId]=48&serendipity[karmaVote]=-2&se
rendipity[karmaId]=50&serendipity[karmaVote]=-2&serendipity[karmaId]=51&amp
;amp;amp;amp;amp;serendipity[karmaVote]=-2&serendipity[karmaId]=52&serendipity[karmaVot
e]=2&serendipity[karmaId]=46&serendipity[karmaVote]=-2&serendipity[karmaId]=45&
amp;serendipity[karmaVote]=1&serendipity[karmaId]=52&serendipity[karmaVote]=1&serendipity[karmaId]=46 HTTP/
1.0" 200 106464 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"


Apart from the fact that the undesired URL (www.destinationthesun.info) doesn't appear to cause much damage, I think that the URL generation could be improved.

In fact, even when someone is not trying to exploit the plugin, after you vote you can find URLs like the following one in the page:

/blog/index.php?&serendipity[karmaVote]=2&serendipity[karmaId]=50&serendipity[karmaVote]=2&serendipity[karmaId]=43#karma_vote43

There seem to be a bit of confusion in the query string ;-)

----------------------------------------------------------------------

Comment By: Jude Anthony (slothman)
Date: 2008-03-19 08:11

Message:
Logged In: YES 
user_id=228551
Originator: NO

I'll have a look at it.  There should only bee one karmaID and one
karmaVote in a link.  I'll find out why that's happening and sanitize the
input while I'm at it.

----------------------------------------------------------------------

Comment By: Simone Tellini (tellini)
Date: 2008-03-18 19:05

Message:
Logged In: YES 
user_id=411163
Originator: YES

my blog is at http://tellini.info - but I've disabled the karma plugin at
the moment.

I haven't touched anything regarding permalinks: they're set to the
default values.

The destinationthesun.info URL is picked from the query string: it seems
like someone was trying an XSS attack of some sort with several different
URLs (that one was just an example from the log). The karma plugin simply
writes all the values it gets from the request in the URL, even though
they're plainly bogus.

As to the second problem (duplication of values in the query string after
a vote), after  a quick look at the code, I guess it's due to the fact that
the url is always created appending the parameters to
serendipity_currentURL(), not considering that after a submit the current
url already has a query string

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2008-03-18 17:49

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thank you for reporting this. Even though many people tested the karma
plugin, this error has not yet surfaced.

First off, what is the URL to your Blog? It looks like this URL is picked
up from somewhere, and misconfigured permalinks MIGHt be a possible
explaination. Did you change anything in your permalink configuration of
the s9y blog?

Regards,
Garvin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/