<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Security issue in the comment template in PmForm.Templates:</div>(:template require text match="-*http:*" errmsg="Please don't post external links":)<br><div><br></div><div>This will still allow https:// links, and other naughty entries. I think it's best to eliminate if there's a colon in it and @ i.e. "-*:*,-*@*,-*<*,-*>*" so that it also covers all PmWiki InterMapped services and email addresses. It doesn't stop "<a href="http://www.example.com">www.example.com</a>" but at least then it's not clickable (unless you have a plugin that changes www->link). One could also eliminate "." depending on which field it is (on my RSVP form it's a "Name" field so it would prevent someone from saying "Rev. Criss" or "Ms. Fuller, P.C."). I took out angle brackets just for good measure -- it will stop much spam dead in its tracks. I may also add a honeypot to the form (a hidden field like "Subject" that spam software would attempt to fill in and an error message that says "please leave Subject blank" in case someone real tries to fill it in).</div><div><br><div>
<p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Comic Sans MS" size="3" style="font: 12.0px Comic Sans MS">Crisses</font></p>
</div>
<br><div><blockquote type="cite"><div>[...]<br>Thank you for your time,<br>Crisses<br></div></blockquote></div><br></div></body></html>