Well, you could generate an unique hash every time you visit newreply.php, store it in the session (as $confirmkey[$Number]) and also put it into as a hidden var in the newreply page. In addpost, you check if the hash value passed through the page matches the one assigned to the post number you are replying (from session). 'Number' is required since you could be replying from several browser windows and you may need many confirm values in the same time. Anyway, this just crossed my mind and, while looking interesting right now it will probably take me several seconds after hitting the submit button to realise a flaw that renders it unusable []/forum/images/icons/smile.gif[/]
[Edit] Doh! You can make your remote script to fetch the real newreply.php page in order to get a hash and then using it to POST the actual data. I don't see right now any serious protection against posting from remote locations (since changing the referer is trivial anyway).
Last edited by razvan; 03/29/2002 5:00 PM.
