Security Enhancement, Keys For Actions

[David]

I guess since you won't always have a username for the person requesting the action (maybe never) you can't really do much.  So if the "Key already exists" error gets logged into the normal board error log not much else you can do.  Only thing maybe is to ban that IP after like 10 failed attempts or something but history shows that the bastards doing bad things usually have ways around IP ban so it would not solve anything.

The thing with the IP banning is I think it is a good idea only if you can do something like ban somebody for 30 minutes.  As a way to say go away but not permenantly.

Other thing is that the check function only returns false if the key doesn't match.  Thus it is up to whoever called the functions to see that and then handle it.

[[Unknown]]

Good idea.  What is the vairable that ID_MEMBER is stored in, like username is $username.

Also is there a function to look up ID_MEMBER given a username?  Like the forgotten password the user inputs the username.

$ID_MEMBER.

Why use a function??

SELECT ID_MEMBER
FROM {$db_prefix}members
WHERE memberName='hi';

(the query only uses keys, so it would be fast too... could be integrated into another query of course...)

As far as the logging.... that's why I seperated the error logging in my secret project.  No there's a log_error function that ONLY logs an error.  (which simplifies things...)

-[Unknown]

[David]

Good idea.  What is the vairable that ID_MEMBER is stored in, like username is $username.

Also is there a function to look up ID_MEMBER given a username?  Like the forgotten password the user inputs the username.

$ID_MEMBER.

Why use a function??

SELECT ID_MEMBER
FROM {$db_prefix}members
WHERE memberName='hi';

(the query only uses keys, so it would be fast too... could be integrated into another query of course...)

As far as the logging.... that's why I seperated the error logging in my secret project.  No there's a log_error function that ONLY logs an error.  (which simplifies things...)

-[Unknown]

Alright, but it will become the reasponsibility of the function that calls new_action_key and check_action_key to provide an ID_MEMBER.