闫鹏 blog

最近发垃圾评论的实在太猖獗了，gae提供的图片模块又没法支撑captcha的能力，个人又不太喜欢直接删除所有纯英文评论的做法，其它的验证码服务搭建起来会使micolog依赖性增强，再加上我懒…

一系列原因，导致我今天做了个小升级，看是否有效果。原理是根据文章id与访客的ip地址生成一个随机数加在网页中，访客通过网页留言的话是正常的，但如果通过工具进行留言，就必须每次重新获取一下随机数。为了增加工具的门槛，以后需要在页面上增加一个js来对随机数混淆，先放上这个简单的看看效果如何:)

blog.py中把这两个类列出来，就不多说了

[code lang='python' style='vs']

class SinglePost(BasePublicPage):
    @cache()
    def get(self,slug=None,postid=None):

        if postid:
            entries = Entry.all().filter("published =", True).filter('post_id =', postid).fetch(1)
        else:
            slug=urldecode(slug)
            entries = Entry.all().filter("published =", True).filter('link =', slug).fetch(1)
            if not entries or len(entries) == 0:
                return self.error(404)

        entry = entries[0]
        addReadTime(entry)
        makeHighlight(entry)

        comments = Comment.all().filter("entry =",entry)
        commentuser = ['','','']
        checknum = random.randint(1, 100000)
        memcache.set(str(entry.key())+self.request.remote_addr, str(checknum), 900)

        tpl_vars = {
            'entry':entry,
            'relateposts':entry.relateposts,
            'comments':comments,
            'user_name':commentuser[0],
            'user_email':commentuser[1],
            'user_url':commentuser[2],
            'checknum':checknum
        }

        if entry.entrytype=='post':
            self.render('single', tpl_vars)
        else:
            self.render('page', tpl_vars)

class Post_comment(BaseRequestHandler):
    #@printinfo
    def post(self,slug=None):
        useajax=self.param('useajax')=='1'
        name=self.param('author')
        email=self.param('email')
        url=self.param('url')

        key=self.param('key')
        content=self.param('comment')
        checknum=self.param('checknum')

        saved_checknum = memcache.get(key+self.request.remote_addr)
        if (not saved_checknum) or (str(saved_checknum) <> checknum):
            if useajax:
                self.write(simplejson.dumps((False,-102,_('Checknum not correct .'))))
            else:
                self.error(-102,_('Checknum not correct .'))
            return
        memcache.delete(key+self.request.remote_addr)

        content=content.replace('\n','<br>')
        content=myfilter.do_filter(content)
        name=cgi.escape(name)[:20]
        url=cgi.escape(url)[:100]

        if not (name and email and content):
            if useajax:
                self.write(simplejson.dumps((False,-101,_('Please input name, email and comment .'))))
            else:
                self.error(-101,_('Please input name, email and comment .'))
        else:
            comment=Comment(author=name,
                            content=content.replace('^~','<img src="http://' + g_blog.domain + "/static/images/icons/icon_").replace('~^','.gif" />'),
                            email=email,
                            entry=Entry.get(key))
            if url:
                try:
                    comment.weburl=url
                except:
                    comment.weburl='http://'+url

            #name=name.decode('utf8').encode('gb2312')

            info_str='#@#'.join([urlencode(name),urlencode(email),urlencode(url)])
            logging.info("info:"+info_str)
            #info_str='#@#'.join([name,email,url.encode('utf8')])
  

60;         cookiestr='comment_user=%s;expires=%s;domain=%s;path=/'%(info_str,(datetime.now()+timedelta(days=100)).strftime("%a, %d-%b-%Y %H:%M:%S GMT"),'')
            comment.save()
            memcache.delete("/"+comment.entry.link)

            self.response.headers.add_header('Set-Cookie', cookiestr)
            if useajax:
                comment_c = self.get_render('comment',{'comment':comment})
                self.write(simplejson.dumps((True,comment_c.decode('utf8'))))
            else:
                self.redirect(self.referer)

[/code]

最后，要记得更新你的comments.html文件，提交的form里面带上checknum

---------------------------------------------------------------
本站作品根据创作共同协议进行授权, 转载时请务必以超链接形式标明文章原始出处
原文地址：http://www.mirecle.com/2009/10/12/upgrade-again-micolg-message-authentication-to-prevent-spam-comments.html
---------------------------------------------------------------

您可能会喜欢:

1. 修正micolog页码输出从零开始的问题
2. 为micolog增加随机文章功能
3. 提供我改过的micolog代码下载
4. gae micolog 验证码
5. 为micolog增加阅读次数统计