Anonymous Comments

taveren · March 9th, 2006, 05:25 PM

It appears someone has managed to post comments to my site without logging in. I've verified that anonymous users cannot post in both the global config and in the categories. I've also verified that comment forms do not show up in the browser while viewing photos without logging in. I can also verify that the offending IP address is POSTing to comments.php, but I don't have a record of what was sent in that POST.

Have I just missed something (likely), or is there a small hole somewhere?

Photopost: 5.3 (totally refreshed all files last update)
phpBB: 2.0.19

Is it possible that an old cookie will still work? The offending IP is a user that was removed from the system.

Chuck S · March 9th, 2006, 05:52 PM

Well unless the user's cookie was dropped midpost I dont see how this would happen other than this if your permissions are set correctly.

taveren · March 9th, 2006, 06:02 PM

The cookie should have long since timed out I'm sure, so I don't image that's really it. But then, nothing else seem's like the problem either. How can we go about verifying for sure that the settings are correct?

I've also tested trying to force a POST to comments.php without success, but this person is definately getting comments into the system and they're showing up as anonymous.

Chuck S · March 9th, 2006, 06:33 PM

How about posting a url?

taveren · March 9th, 2006, 07:43 PM

http://www.canadianphotoclub.com

Chuck S · March 9th, 2006, 08:04 PM

Okay I am not able to post a comment without logging in. Is there a specific category to test. Everything looks fine from this end.

taveren · March 9th, 2006, 08:06 PM

This photo was commented on by this anonymous person.

http://www.canadianphotoclub.com/gal...7&limit=recent

Edit: I, of course, deleted the comment, as it wasn't supposed to be there.

taveren · March 9th, 2006, 08:14 PM

Here's one comment I missed in my mass deletion.

http://www.canadianphotoclub.com/gal...php?photo=7734

Chuck S · March 10th, 2006, 04:52 AM

Well I will look at your settings if you want but I see no way to post an anonymous comment on your system now.

geofflaw · May 4th, 2008, 01:37 PM

Sorry to re-open an old thread but I am getting exactly the same problem. I have set that guests cannot comment on pictures yet here you can see that someone has.

http://www.geofflawrence.com/photopo....php/photo/212

The visitor left about 8 or 10 such comments. Is there another setting that needs to be set?

I also notice that, if I logout of my phpBB3 forum and go to the photopost gallery, it says 'welcome anonymous' and the menu at top right says 'logout' implying that I am logged in as 'anonymous'. But, in this case, I do not see the comments entry box, so it's probably not relevant.

Chuck S · May 4th, 2008, 08:31 PM

anonymous is actually a user in phpbb3

You could make sure line 528 in our file is this.

Code:

Content visible to verified customers only.

geofflaw · May 5th, 2008, 02:36 PM

It didn't, it just said $userid. So I changed it to $phpbb_userid. Do you think that will solve the problem? I'm not sure how to test it.

Chuck S · May 5th, 2008, 03:22 PM

If the line is that then if you visit the gallery to make sure it does work you should not be logged in as anonymous.

wingnut1 · May 26th, 2008, 05:14 PM

I'm getting this issue today. My comments appear anonymous even though I'm logged in as admin and can see my username and the admin link at the top of the gallery.

Chuck S · June 5th, 2008, 07:58 AM

That is interesting. What is the link a login and integration type?

Mike-L · June 18th, 2008, 10:56 AM

Just a note to say that I have been getting pounded by this issue for the last couple months and only just came here, did a search for "anonymous" and found this topic.

Only two images have been targeted.

At first, the IPs were consistently from a block of IPs out of Russia. I disallowed that IP range via my .htaccess file and that cleared things up for a few weeks.

Then about a week ago, I started getting pounded again from a different range of IPs. I have been adding them to the .htaccess file one at a time and then this morning got ticked off at all the trouble and just turned off the comments feature within Photopost.

Not in a hurry to turn comments back on until issue is resolved. The links in these spam postings are to rather nasty URLs.

When the comments were turned on, I confirmed that "guests" (non-logged in users) cannot post comments. However, someone has a bot that can get around this as there would be several a day from "anonymous".

Link to site is http://www.boatingabc.com/photos/.

Integrated with Threads 7.3.

A note is that my Threads forums do not have this issue. It seems that only the photo site is targeted.

If you would like a user account to test things, ask me in private and I will provide one. I will do what I can to help. I will also provide you all IPs I have blocked to date if you like.

EDIT:

I think I am one version behind and will upgrade as soon as I get a chance. Am also going to do more reading here.

Chuck S · June 18th, 2008, 11:01 AM

You can send any relevant data to chuck at photopost dot com and I will take a look.

Mike-L · June 18th, 2008, 11:20 AM

Thanks. Will do so a bit later today. Can't access all of what I need through work proxy server.

Chuck S · June 18th, 2008, 01:02 PM

Not a problem not able to get guests to comment here without assigning permissions so we would have to find out what is going on.