最近发垃圾评论的实在太猖獗了，gae提供的图片模块又没法支撑captcha的能力，个人又不太喜欢直接删除所有纯英文评论的做法，其它的验证码服务搭建起来会使micolog依赖性增强，再加上我懒…
一系列原因，导致我今天做了个小升级，看是否有效果。原理是根据文章id与访客的ip地址生成一个随机数加在网页中，访客通过网页留言的话是正常的，但如果通过工具进行留言，就必须每次重新获取一下随机数。为了增加工具的门槛，以后需要在页面上增加一个js来对随机数混淆，先放上这个简单的看看效果如何:)
blog.py中把这两个类列出来，就不多说了
[code lang='python' style='vs']
class SinglePost(BasePublicPage):
@cache()
def get(self,slug=None,postid=None):
if postid:
entries = Entry.all().filter("published =", True).filter('post_id =', postid).fetch(1)
else:
slug=urldecode(slug)
entries = Entry.all().filter("published =", True).filter('link =', slug).fetch(1)
if not entries or len(entries) == 0:
return self.error(404)
entry = entries[0]
addReadTime(entry)
makeHighlight(entry)
comments = Comment.all().filter("entry =",entry)
commentuser = ['','','']
checknum = random.randint(1, 100000)
memcache.set(str(entry.key())+self.request.remote_addr, str(checknum), 900)
tpl_vars = {
'entry':entry,
'relateposts':entry.relateposts,
'comments':comments,
'user_name':commentuser[0],
'user_email':commentuser[1],
'user_url':commentuser[2],
'checknum':checknum
}
if entry.entrytype=='post':
self.render('single', tpl_vars)
else:
self.render('page', tpl_vars)
class Post_comment(BaseRequestHandler):
#@printinfo
def post(self,slug=None):
useajax=self.param('useajax')=='1'
name=self.param('author')
email=self.param('email')
url=self.param('url')
key=self.param('key')
content=self.param('comment')
checknum=self.param('checknum')
saved_checknum = memcache.get(key+self.request.remote_addr)
if (not saved_checknum) or (str(saved_checknum) <> checknum):
if useajax:
self.write(simplejson.dumps((False,-102,_('Checknum not correct .'))))
else:
self.error(-102,_('Checknum not correct .'))
return
memcache.delete(key+self.request.remote_addr)
content=content.replace('\n','<br>')
content=myfilter.do_filter(content)
name=cgi.escape(name)[:20]
url=cgi.escape(url)[:100]
if not (name and email and content):
if useajax:
self.write(simplejson.dumps((False,-101,_('Please input name, email and comment .'))))
else:
self.error(-101,_('Please input name, email and comment .'))
else:
comment=Comment(author=name,
content=content.replace('^~','<img src="http://' + g_blog.domain + "/static/images/icons/icon_").replace('~^','.gif" />'),
email=email,
entry=Entry.get(key))
if url:
try:
comment.weburl=url
except:
comment.weburl='http://'+url
#name=name.decode('utf8').encode('gb2312')
info_str='#@#'.join([urlencode(name),urlencode(email),urlencode(url)])
logging.info("info:"+info_str)
#info_str='#@#'.join([name,email,url.encode('utf8')])
60; cookiestr='comment_user=%s;expires=%s;domain=%s;path=/'%(info_str,(datetime.now()+timedelta(days=100)).strftime("%a, %d-%b-%Y %H:%M:%S GMT"),'')
comment.save()
memcache.delete("/"+comment.entry.link)
self.response.headers.add_header('Set-Cookie', cookiestr)
if useajax:
comment_c = self.get_render('comment',{'comment':comment})
self.write(simplejson.dumps((True,comment_c.decode('utf8'))))
else:
self.redirect(self.referer)
[/code]
最后，要记得更新你的comments.html文件，提交的form里面带上checknum
---------------------------------------------------------------
本站作品根据创作共同协议进行授权, 转载时请务必以超链接形式标明文章原始出处
原文地址：http://www.mirecle.com/2009/10/12/upgrade-again-micolg-message-authentication-to-prevent-spam-comments.html
---------------------------------------------------------------
