Hardening article writing #25
Labels
Priority: Medium
The Issue must be addressed as soon as possible
Security issue
A potential security issue
Severity: Major
The bug or Issue prevent a feature from working or present a possible security issue
Context:
The blog as it has been released on v0.1.0 seems really vulnerable to DB filling to me.
Problem:
I didn't tried it but it shouldn't be impossible for anyone to write a simple python script submitting millions of new articles filling the iScsc database.
This also brought to my attention that at the moment nothing forbid a non iScsc member to create an account and write a blog... not that we want to be sectarian but that also means that anyone can write anything, potentially non-related subject or worse...
Solution:
First of all we should at least add a Captcha or something to prevent a bot from being able to submit an article.
Additionally, I would like to let only iScsc member write article for the time being, for example with a
iScsc
badge added to the profile page, which would fit nicely I think to the v0.2.0Later we should maybe add a review step from iScsc member for articles submitted by non-members, and limit pending articles to a reasonable number, once again to prevent DB filling.
The text was updated successfully, but these errors were encountered: