Closed (duplicate)
Project:
Drupal core
Version:
4.7.3
Component:
comment.module
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
5 Jun 2006 at 14:00 UTC
Updated:
12 Jan 2007 at 14:32 UTC
Within a few minutes of upgrading our 4.7.0 to 4.7.2, I've seen five blank comments posted to the site - no body or subject. It is not possible to enter one manually, as drupal says an empty body is invalid. But somehow they are being submitted.
I'm assuming they are from a spammer, since we normally only get a few comments per day, yet these arrived within a few minutes from different IP addresses. I have not had this problem before with 4.6.x or 4.7.0.
As a temporary fix I'll set access control to prevent unauthorised users from posting without approval, but any ideas if this is a bug or some mistake at my side?
Many thanks, MrB
Comments
Comment #1
mrb commentedI've just installed captcha, thinking that will stop the problem. Captcha is working, and non-authenticated users must now type the textimage before they can post a comment. But the blank comments are still being created. Here are the log entries for the last three, all from different hosts:
Type content
Date Tuesday, June 6, 2006 - 10:43
User Anonymous
Location http://www.batgung.com/drupal/comment/reply/361?PHPSESSID=9ef88abaccc86c...
Referrer http://www.batgung.com/drupal/comment/reply/361?PHPSESSID=9ef88abaccc86c...
Message Comment: added .
Severity notice
Hostname 125.244.157.66
Type content
Date Tuesday, June 6, 2006 - 10:38
User Anonymous
Location http://www.batgung.com/drupal/comment/reply/379?PHPSESSID=da0234fc4e65d8...
Referrer http://www.batgung.com/drupal/comment/reply/379?PHPSESSID=da0234fc4e65d8...
Message Comment: added .
Severity notice
Hostname 125.244.111.130
Type content
Date Tuesday, June 6, 2006 - 10:37
User Anonymous
Location http://www.batgung.com/drupal/comment/reply/431?PHPSESSID=7b72a923bc409c...
Referrer http://www.batgung.com/drupal/comment/reply/431?PHPSESSID=7b72a923bc409c...
Message Comment: added .
Severity notice
Hostname 195.175.37.6
MrB
Comment #2
mrb commentedSee http://drupal.org/node/67972
Comment #3
mrb commentedMaybe this isn't a duplicate after all. The problem I was having was that I was being spammed with empty comments, but I think the 'comments' were zero byte posts (see web server log snippet below showing the get-post-get sequence that happens each time).
The solution was to make the change suggested at http://drupal.org/node/67972. That incident has been closed, with the reason given that it is not easy to detect a user's empty content. But what if the post itself had no data - is it fair to consider that invalid?
Regards, MrB
65.200.179.195 - - [08/Jun/2006:02:46:48 -0500] "GET /drupal/comment/reply/295?PHPSESSID=507b0c161d62086617230826e06158a3 HTTP/1.0" 200 17339 "http://www.batgung.com/drupal/comment/reply/295?PHPSESSID=507b0c161d6208..." "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8) Gecko/20051111 Firefox/1.5"
65.200.179.195 - - [08/Jun/2006:02:46:50 -0500] "POST /drupal/comment/reply/295?PHPSESSID=507b0c161d62086617230826e06158a3 HTTP/1.0" 302 0 "http://www.batgung.com/drupal/comment/reply/295?PHPSESSID=507b0c161d6208..." "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8) Gecko/20051111 Firefox/1.5"
65.200.179.194 - - [08/Jun/2006:02:46:51 -0500] "GET /twosquaremeterman#comment-3726 HTTP/1.0" 200 16408 "http://www.batgung.com/drupal/comment/reply/295?PHPSESSID=507b0c161d6208..." "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8) Gecko/20051111 Firefox/1.5"
Comment #4
magico commentedI'm marking this as bug report, because (at least) we should not allow blank posts.
Comment #5
magico commentedDuplicate of http://drupal.org/node/67972