Re: comments enhancements

On Dec 8, 2004, at 9:29 PM, Bill Mill wrote:

> On Wed, 8 Dec 2004 21:25:49 -0500, Bill Mill <[email protected]> 
> wrote:
>>> 2. Secret number image thingy. Depends on my plugin 'nospam', which
>>> itself depends on 'session'. They can be found here:
>>> http://www.c-area.ch/code/pyblosxom/plugins/
>>>
>>
>> Aww man, I was totally gonna do that. It was gonna be a neat little
>> PIL hack. Good stuff, you beat me to it. It looks exactly like I was
>> going to make it look. One question: how does it work with cgi? Does
>> it? Do you embed its value in a form?
>>
>> I had a thought that, if you wanted to embed the number in a form, you
>> could do it and still be succesful. How? Simply by having a secret
>> multiplier stored in config.py. Before sticking the number in the
>> form, you'd multiply it by the number in config.py (which should be
>> world-inaccessible), and when you decode it, simply divide it by that
>> number. I thought that would be another neat little hack.
>>
>
> Oh man that totally wouldn't work. It's a good thing I don't do 
> security.

What would work is if you had a hash of the number plus a secret as a 
hidden form field.  The server-side will verify that hash(input+secret) 
== input_hash.

I would guess that this is what it does, not having looked at the 
source, because it's so common...

-bob



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/