ScreenShottr / Screenshottr-Web

The web server side of the ScreenShottr Service
https://www.screenshottr.us
1 stars 3 forks source link

Add captcha to prevent server flooding #5

Open Kent55 opened 6 years ago

Kent55 commented 6 years ago

Currently the ScreenShottr website allows users to upload images directly from their browser. Due to the fact the form has no captcha test, a user could write a script to upload files on mass in a continuous loop. In turn this would flood the server.

A captcha seems the simplest for the existing web version of ScreenShottr. A more secure token regeneration will be implemented in the new one.

This will be covered in the new version of the website, however a fix needs to be applied to the current web system.

This issue was brought to my attention by a colleague at work.

@TheCJGCJG Would you also mind uploading the existing db to the repo?

TheCJGCJG commented 6 years ago

Yep, i'll add a DB Schema this evening for you

TheCJGCJG commented 6 years ago

I havent got a DB Schema to hand but these are the create syntax's for it, if we're updating this we should probably remove pravius etc too.

CREATE TABLE `imageuploads` (
  `ID` int(11) NOT NULL AUTO_INCREMENT,
  `FileName` varchar(45) DEFAULT NULL,
  `Encrypted` int(11) DEFAULT NULL,
  `secret` varchar(45) DEFAULT NULL,
  `UploadTimeStamp` int(11) DEFAULT NULL,
  `LastViewedTimeStamp` int(11) DEFAULT NULL,
  `FilesizeInBytes` int(11) DEFAULT NULL,
  `TimesViewed` int(11) DEFAULT NULL,
  `PraviUS` int(11) DEFAULT NULL,
  `PraviUSID` varchar(45) DEFAULT NULL,
  `PraviUSAdmin` varchar(45) DEFAULT NULL,
  PRIMARY KEY (`ID`)
) ENGINE=MyISAM AUTO_INCREMENT=22417 DEFAULT CHARSET=latin1;
CREATE TABLE `users` (
  `ID` int(11) NOT NULL AUTO_INCREMENT,
  `IP` varchar(45) DEFAULT NULL,
  `FirstVisited` int(11) DEFAULT NULL,
  `LastVisited` int(11) DEFAULT NULL,
  `TimesVisited` int(11) DEFAULT NULL,
  PRIMARY KEY (`ID`),
  UNIQUE KEY `IP` (`IP`)
) ENGINE=MyISAM AUTO_INCREMENT=22238 DEFAULT CHARSET=latin1;