Closed (fixed)
Project:
OPAL
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Reporter:
Created:
1 Jul 2011 at 03:14 UTC
Updated:
19 Sep 2011 at 16:52 UTC
It's not clear to me why this callback exists at all, since there doesn't appear to be anything calling it. It's strange to have an "access content" callback in the admin section, but more than that, it seems like an easy way to crash a site with a DoS attack. Requests to that URL can fire off a second request to api.microsofttranslator.com, wait until that responds, then do a series of database queries. The callback should at least have its own permission so site administrators can decide how open they want to make such a resource-hungry process.
Comments
Comment #1
FernandoTapiaRico commentedHi,
the HTTP service was something cool for checking the polarity results, but you are right...in a normal Drupal instance is kinda pointless and it could be an easy way to crash the site via a DoS attack. Having these things into consideration, I removed the code from the module.
Commit:
http://drupalcode.org/sandbox/FernandoTapiaRico/1085144.git/commit/28d3b93
Comment #2
FernandoTapiaRico commentedComment #3
FernandoTapiaRico commented