Hello,
je faisais une session de questions-réponses sur les forums de spip-contrib, et tout d'un coup j'ai eu une erreur 400, avec impossibilité de continuer à naviguer sur le site.
Les cookies de forum sont devenus trop gros et provoquent un header qui n'est plus licite.
Il faudrait sans doute purger le cookie cote serveur à chaque fois qu'un post est enregistré, non ?
Cédric
400 Bad Request
Your browser sent a request that this server could not understand.
Size of a request header field exceeds server limit.
Cookie: spip_contenu_formulaire_3028____=on%20attend%20le%20zip%20avant%20de%20publier; spip_contenu_formulaire_3028__416165__=oups%2C%20non%20c'%C3%A9tait%202857; spip_contenu_formulaire_3033__416151__=Ca%20n'est%20pas%20suffisant.%20On%20ne%20peut%20pas%20encourager%20la%20diffusion%20d'un%20plugin%20qui%20ouvre%20un%20trou%20de%20s%C3%A9curit%C3%A9%20aussi%20grave%20puisqu'il%20permet%20de%20defacer%20un%20site%2C%20vider%20la%20base%20de%20donn%C3%A9es%2C%20publier%20du%20contenu%20diffamant%20etc%20...; spip_contenu_formulaire_3041__416060__=J'aurais%20bien%20vu%20%C3%A7a%20dans%20un%20plugin%20qui%20%0A-%20importe%20la%20base%20de%20test%20%C3%A0%20l'installation%20en%20notant%20les%20contenus%20cr%C3%A9%C3%A9s%0A-%20nettoie%20les%20donn%C3%A9es%20de%20test%20%C3%A0%20la%20d%C3%A9sinstallation%20(en%20pr%C3%A9servant%20optionnellement%20les%20contenus%20cr%C3%A9%C3%A9s%20par%20les%20utilisateurs%20entre%20temps); spip_contenu_formulaire_3043____=Pour%20l'administration%20des%20photos%20dans%20l'espace%20priv%C3%A9%2C%20as%20tu%20regard%C3%A9%20le%20plugin%20gestion_documents%20%3F%0A%0AIl%20offre%20une%20interface%20d%C3%A9j%C3%A0%20tr%C3%A8s%20compl%C3%A8te%20sur%20laquelle%20tu%20peux%20te%20reposer%20et%20que%20tu%20peux%20%C3%A9ventuellement%20compl%C3%A9ter%20si%20il%20y%20a%20des%20manques.%20Il%20a%20vocation%20%C3%A0%20%C3%AAtre%20int%C3%A9gr%C3%A9%20dans%20la%20distribution%20du%20core%20pour%20la%20prochaine%20version%20de%20SPIP.%0A%0ACa%20serait%20mieux%20que%20de%20re-d%C3%A9velopper%20une%20n-i%C3%A8me%20fois%20une%20interface.; spip_contenu_formulaire_3028__416172__=ok%2C%20merci%20pour%20les%20retours%2C%20j'en%20ai%20tenu%20compte%20pour%20corriger%20le%20texte; spip_contenu_formulaire_3042____=J'ai%20fait%20du%20m%C3%A9nage%20dans%20les%20mots%20cl%C3%A9s%2C%20mais%20sinon%20%C3%A7a%20me%20parait%20ok; spip_contenu_formulaire_3008__416028__=Je%20pense%20que%20si%20le%20webmestre%20intervient%20manuellement%2C%20il%20faut%20lui%20laisser%20la%20main.%0ADonc%20j'ai%20revert%0Ahttp%3A%2F%2Fzone.spip.org%2Ftrac%2Fspip-zone%2Fchangeset%2F28525%0Aaussi%20pour%20des%20raisons%20de%20perfo.%0A%0AJ'ai%20pass%C3%A9%20tetue%20sous%20la%20question%20(comme%20on%20disait%20en%20des%20temps%20troubl%C3%A9s)%20et%20elle%20est%20maintenant%20d'accord.%0A%0AVoila%20-%3E%20publication%0A; spip_contenu_formulaire_3008__416180__=; spip_contenu_formulaire_3033__416181__=La%20s%C3%A9curit%C3%A9%20est%20un%20sujet%20sensible%20et%20l'exp%C3%A9rience%20montre%20qu'il%20ne%20faut%20pas%20attendre%20des%20utilisateurs%20qu'ils%20y%20fassent%20attention%20car%20ils%20ont%20souvent%20peu%20conscience%20de%20ce%20probl%C3%A8me.%0A%0ALa%20bonne%20mani%C3%A8re%20de%20proc%C3%A9der%20serait%20donc%20plut%C3%B4t%20d'int%C3%A9grer%20par%20d%C3%A9faut%20les%20s%C3%A9curit%C3%A9s%20et%20v%C3%A9rifications%20n%C3%A9cessaires%20pour%20emp%C3%AAcher%20l'utilisation%20du%20plugin%20comme%20porte%20d%C3%A9rob%C3%A9e%2C%20en%20indiquant%20%C3%A9ventuellement%20aux%20d%C3%A9veloppeur%20comment%20enlever%20cette%20s%C3%A9curit%C3%A9%20%C3%A0%20leurs%20risques%20et%20p%C3%A9rils.%0A%0APar%20ailleurs%2C%20le%20correctif%20que%20tu%20propose%20dans%20l'article%20bas%C3%A9%20sur%20%3Ccode%3Ef%20(isset(%24_POST%5B%22inc%22%5D)%20%26%26%20in_array(%24_POST%5B%22inc%22%5D%2C%24valid_inc))%20%3C%2Fcode%3E%20ne%20corrige%20pas%20l'attaque%20type%20que%20je%20t'ai%20indiqu%C3%A9%20dans%20mon%20premier%20post%2C%20bas%C3%A9%20sur%20l'appel%20de%20%3Ccode%3Efile_get_contents('config%2Fconnect.php')%3C%2Fcode%3E%20qui%20permet%20de%20r%C3%A9veller%20le%20mot%20de%20passe%20de%20la%20bdd.%0A%0AMais%20pleins%20de%20variantes%20sont%20possibles%20comme%20un%20appel%20a%20%3Ccode%3Espip_query(%22delete%20form%20spip_articles%22)%3C%2Fcode%3E%2C%20%3Ccode%3Eexec(%22cat%20.%2Fetc%2Fpassword%22)%3C%2Fcode%3E%20%20etc%20...%0A%0AA%20partir%20du%20moment%20o%C3%B9%20on%20donne%20acc%C3%A8s%20par%20javascript%20%C3%A0%20toutes%20les%20fonctions%20de%20php%20et%20toutes%20les%20fonctions%20de%20base%20de%20spip%20c%C3%B4t%C3%A9%20serveur%2C%20il%20est%20trivial%20pour%20n'importe%20quel%20hacker%20de%20les%20utiliser%20pour%20prendre%20possession%20du%20site%2C%20voir%20du%20serveur.%0A%0AAutant%20l'utilisation%20d'un%20tel%20plugin%20%C3%A0%20titre%20individuel%20n'est%20pas%20tr%C3%A8s%20g%C3%AAnante%20car%20la%20faille%20n'est%20pas%20publique%2C%20autant%20sa%20diffusion%20via%20spip-contrib%20permet%20%C3%A0%20quiconque%20de%20savoir%20que%20ce%20plugin%20ouvre%20pleins%20de%20failles%2C%20et%20de%20les%20utiliser%20sur%20tous%20les%20sites%20qui%20l'utilisent.%0A%0ANe%20prend%20pas%20cela%20comme%20une%20attaque%20personnelle%2C%20ni%20une%20critique%20d%C3%A9valorisante%20de%20ton%20travail%2C%20qui%20%C3%A0%20son%20int%C3%A9r%C3%AAt%20et%20son%20utilit%C3%A9.%20Il%20y%20a%20parfois%20des%20solutions%20techniques%20qu'on%20peut%20se%20permettre%20de%20mettre%20en%20oeuvre%20sur%20un%20site%20donn%C3%A9%20en%20comptant%20sur%20le%20fait%20que%20les%20failles%20de%20s%C3%A9curit%C3%A9%20ne%20peuvent%20pas%20%C3%AAtre%20devin%C3%A9e%2C%20ou%20que%20la%20probabilit%C3%A9%20ou%20le%20risque%20est%20faible%2C%20mais%20les%20diffuser%20%C3%A0%20grande%20%C3%A9chelle%20en%20permettant%20leur%20utilisation%20massive%20sur%20plein%20de%20sites%20est%20par%20contre%20tr%C3%A8s%20n%C3%A9faste%20%C3%A0%20l'%C3%A9cosyst%C3%A8me.%0A%0ALes%20failles%20de%20s%C3%A9curit%C3%A9%20graves%20et%20leurs%20dommages%20potentiels%20entra%C3%AEn%C3%A9s%20par%20la%20diffusion%20d'une%20contribution%20sont%20donc%20une%20raison%20l%C3%A9gitime%20pour%20refuser%20la%20publication%20d'un%20travail%2C%20ind%C3%A9pendamment%20de%20sa%20valeur%20et%20de%20la%20qualit%C3%A9%20du%20code%20et%20de%20la%20documentation.%0A%0AEn%20ce%20qui%20concerne%20la%20charge%20de%20la%20preuve%2C%20je%20t'ai%20donn%C3%A9%203%20exemples%20d'attaques%20types%2C%20je%20pense%20que%20c'est%20significatif%20et%20suffisant.; spip_contenu_formulaire_3033__416184__=Je%20comprends%20ta%20d%C3%A9ception.%20Je%20n'ai%20pas%20de%20solution%20toute%20faite%20%C3%A0%20te%20proposer.%0A%0AJe%20pense%20que%20intrins%C3%A8quement%20le%20concept%20de%20donner%20acc%C3%A8s%20%C3%A0%20toutes%20les%20fonctions%20php%20c%C3%B4t%C3%A9%20serveur%20par%20une%20fonction%20javascript%20via%20une%20requ%C3%AAte%20http%20est%20probl%C3%A9matique%20en%20terme%20de%20s%C3%A9curit%C3%A9.%0A%0AC'est%20certes%20s%C3%A9duisant%20car%20cela%20permet%20un%20d%C3%A9veloppement%20plus%20rapide%20en%20ajoutant%20des%20fonctions%20ajax%20uniquement%20c%C3%B4t%C3%A9%20javascript.%0A%0APeut%20%C3%AAtre%20faudrait-il%20envisager%20un%20mode%20'd%C3%A9veloppeur'%20sans%20s%C3%A9curit%C3%A9%20qui%20permet%20de%20d%C3%A9velopper%20rapidement%2C%20puis%20un%20mode%20'production'%20dans%20lequel%20la%20liste%20des%20appels
