Re: [PHP] XSS via curl

2005-11-30 Thread Silvio Porcellana [tradeOver]
Sandy Keathley wrote: > > Is there a way to detect that a script is being accessed by curl, and > not by a browser? ENV ($_SERVER) variables won't work, as > those can be forged. > Use a CAPTCHA test: http://en.wikipedia.org/wiki/Captcha HTH, cheers! Silvio -- tradeOver | http://www.tradeo

Re: [PHP] XSS via curl

2005-11-30 Thread Chris Shiflett
Sandy Keathley wrote: My company uses a home-grown formmail script for clients , and someone is using curl to inject HTTP headers and spam email addresses, and turn it into an open relay. Yes, I know the right answer is to not use a formmail, but I don't make the rules here. Is there a way to de

Re: [PHP] XSS via curl

2005-11-30 Thread Jochem Maas
Sandy Keathley wrote: My company uses a home-grown formmail script for clients , and someone is using curl to inject HTTP headers and spam email addresses, and turn it into an open relay. Yes, I know 1. cut out the ability for the poster (form submitter) to determine who is addressed. 2. str

[PHP] XSS via curl

2005-11-30 Thread Sandy Keathley
My company uses a home-grown formmail script for clients , and someone is using curl to inject HTTP headers and spam email addresses, and turn it into an open relay. Yes, I know the right answer is to not use a formmail, but I don't make the rules here. Is there a way to detect that a script i