[pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread Sandy
Lock down your sandboxes. Someone has discovered how to find and spam them. Several thousand edits over a few hours, and the refresh didn't seem to happen. It used up our server time, and the processes were still running. (The host had to kill them manually, and reset our limits.) It snuck

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread jdd
Le 03/08/2014 16:08, Sandy a écrit : Lock down your sandboxes. Someone has discovered how to find and spam them. I had spam in my sandbox too, thanks jdd -- http://www.dodin.org ___ pmwiki-users mailing list pmwiki-users@pmichaud.com

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread StefCT
On 08/03/2014 04:21 PM, jdd wrote: Le 03/08/2014 16:08, Sandy a écrit : Lock down your sandboxes. Someone has discovered how to find and spam them. I had spam in my sandbox too, thanks Who does this? Must be quite useless, considering that for external links, PmWiki has rel=nofollow enabled

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread jdd
Le 03/08/2014 16:24, StefCT a écrit : On 08/03/2014 04:21 PM, jdd wrote: Le 03/08/2014 16:08, Sandy a écrit : Lock down your sandboxes. Someone has discovered how to find and spam them. I had spam in my sandbox too, thanks Who does this? Must be quite useless, considering that for external

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread StefCT
On 08/03/2014 04:29 PM, jdd wrote: Le 03/08/2014 16:24, StefCT a écrit : On 08/03/2014 04:21 PM, jdd wrote: Le 03/08/2014 16:08, Sandy a écrit : Lock down your sandboxes. Someone has discovered how to find and spam them. I simply removed the page (delete) Assigning an edit password to

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread jdd
Le 03/08/2014 16:34, StefCT a écrit : Assigning an edit password to either the Sandbox or to the entire Main group should work as well (using action=attr): http://www.pmwiki.org/wiki/PmWiki/Passwords my wiki is only editable by me, is the sandbox protected as default? no other page have been

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread StefCT
On 08/03/2014 04:38 PM, StefCT wrote: On 08/03/2014 04:36 PM, jdd wrote: Le 03/08/2014 16:34, StefCT a écrit : Assigning an edit password to either the Sandbox or to the entire Main group should work as well (using action=attr): http://www.pmwiki.org/wiki/PmWiki/Passwords my wiki is only

Re: [pmwiki-users] Server problems -- pmwiki causing high usage -- ideas?

2014-08-03 Thread Petko Yotov
Reading your other message to the list, I would suppose that spambots have abused all your shared resources. This is fixable by setting an edit password to the wiki, and checking permissions for individual pages/groups by visiting the page SiteAdmin.AuthList as suggested in the other thread.

Re: [pmwiki-users] Sandbox Hack -- Public Service Announcement

2014-08-03 Thread Petko Yotov
Sandy writes: Question: How do I lock down the sandbox? It's been a long time since I activated it. The page Main.WikiSandbox coming with the devault installation has the same permissions as the Main group (and most often as the wiki). If you have an edit password on the wiki like you