• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Vulnerability API.

Amato

Amato

Chevereto Member
I noticed that the API is very vulnerable. With it you can create a heavy load on the server and the HDD.
Example:http://www.domain.com/api?&format=txt&upload=http://link.com/xxx.jpg

Thus, you can open a browser, paste this link to go there, and constantly update the page. Do not be a programmer, that would automate this process.

Example: Opera => Open over 100+ tab => Paste link's => Updated page once per second.
 
There is any difference in that you flood any other website? Nope.. This is something that PHP can't handle because there is no way of leting PHP doing someone else job. PHP is triggered once the request is accepted by the webserver and is stupid to handle the flood in php because it doesn't have all the machine to do it.

This things (although have been taken into account for 2.1) is mostly a server issue because is the webserver who handles the request and the webserver CAN handle this flooding attempts. For instance, a cheap way to avoid this is use cloudflare and the best that you can do is set a daemon that shutdown every flood attempt.

If you point out this, what is the difference in making flood to this forum? php has to call mysql, mysql server is loaded, bla bla bla. Is a thing that the request handler must avoid, not php

And if you have 10K calls to your api (human calls, not flood attempts) who must satisfy those calls? The server. If your server is cheap yo shouldn't dream about that huge usage... Simple as that.
 
I can do a php filter but I assure you that is not the definitive solution. A flood prevention will be applied on 2.1
 
Rodolfo said:
I can do a php filter but I assure you that is not the definitive solution. A flood prevention will be applied on 2.1
Click to expand...

Ouch! That API one can be used badly, people can make spam bots like it refreshes the site each 1 sec.. and you'll end up with a milion images lol
 
Mcmar said:
Rodolfo said:
I can do a php filter but I assure you that is not the definitive solution. A flood prevention will be applied on 2.1
Click to expand...

Ouch! That API one can be used badly, people can make spam bots like it refreshes the site each 1 sec.. and you'll end up with a milion images lol
Click to expand...

read my previous response
 
You must log in or register to reply here.
Back
Top