0

I have an action URL, index.php?ACT=23, that calls a function which inserts some info into the database.

This is being called from an AJAX function, so I can't control where it is called from.

My concern is that it would be easy to set up a script to call this URL repeatedly and thus insert loads of data and probably bring the site down.

Should I be concerned, what can I do to prevent this?

2

What data does the script which is being triggered with action URL accept? If that's EE form submission, then you should not worry if you follow standard EE forms security settings/practice.

If it's a custom script that accepts ANY data, then you of course might need to add additional protection to it.

There's a separate chapter in EE docs on security guidelines. Make sure your add-on follows those, specifically look into "Cross Site Request Forgery" section.

The short answer is: it's impossible to answer your question without seeing the code.

|improve this answer|||||
  • It's a custom script that accepts 2 posted values, I'm more concerned that the script could be called repeatedly, and if EE supplies something to help avoid that? – wot Mar 13 '15 at 17:51
  • There's a separate chapter in EE docs on security guidelines. Specifically look into "Cross Site Request Forgery" section. – Yuri Salimovskiy Mar 13 '15 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.