FriendsOfShopware / FroshShareBasket

This plugin allows your customers to save the current basket and share it via link.
MIT License
8 stars 5 forks source link

secure against db flooding #7

Closed dneustadt closed 5 years ago

dneustadt commented 5 years ago

https://github.com/FriendsOfShopware/FroshShareBasket/blob/238c7bfca6f1a10f9e42eb9d32452b31a21dc8d6/Controllers/Frontend/ShareBasket.php#L79

Massively requesting that endpoint could result in a flooded database. How about a session-based timeout or storing the unique basket code once inserted and updating the according record on subsequent requests?

Edit: Maybe consider using an ajax post request to save the basket. Shopware's CSRF protection can provide some security against automated spam.