EnglishAnnouncement
- [2026-05-03] Piwigo 16.4.0 : because security matters
- [2026-02-24] Piwigo 16.3.0 : security fixes and docker update
- [2025-12-30] Piwigo 16.2.0 : customize Standard Pages
- [2025-12-02] Piwigo 16.1.0 : better compatibility with old/new PHP versions
- [2025-11-24] Piwigo 16 : Standard pages, API keys, Docker image
#1 2008-06-29 14:21:09
- plg
- Piwigo Team
- Nantes, France, Europe
- 2002-04-05
- 14081
[webservice] pwg.images.addComment and key parameter
I'm playing with the fantastic features provided by webservices. I didn't understand what the "key" parameter was in the pwg.images.addComment method. First I thought it was the partner key, so I created a partner key and tried it. It was not a partner key. As I am a PhpWebGallery developer, and I know how to search in the code, I've found that there was a hidden "key" field in the comment form on picture.php (details on [Bugtracker] ticket 625).
Code:
<input type="hidden" name="key" value="1214741017:8ddce3cc7c3a21beb6e6c1b99baeeeae" />
So the "key" parameter you have to give in the pwg.images.addComment webservice method is this form key. Considering this key is time related (60 minutes expiration) and that time may be different between webservice client and webservice server, I would say that it is quite difficult to use this webservice method, am I right? Of course it is difficult, and this is exactly the purpose of [Bugtracker] ticket 625, so why do we provide this method?
Offline
#2 2008-06-29 14:33:37
- rvelices
- Former Piwigo Team
- 2005-12-29
- 1960
Re: [webservice] pwg.images.addComment and key parameter
z0rglub wrote:
So the "key" parameter you have to give in the pwg.images.addComment webservice method is this form key. Considering this key is time related (60 minutes expiration) and that time may be different between webservice client and webservice server, I would say that it is quite difficult to use this webservice method, am I right? Of course it is difficult, and this is exactly the purpose of [Bugtracker] ticket 625, so why do we provide this method?
I think you are to retrieve the key before calling addComment. You do that by calling images.getInfo ...
The idea is to make sure you cannot have a robot that posts always the same thing (most of the stupid robots wotk this way)
Last edited by rvelices (2008-06-29 14:40:40)
Offline
#3 2008-06-29 14:51:11
- plg
- Piwigo Team
- Nantes, France, Europe
- 2002-04-05
- 14081
Re: [webservice] pwg.images.addComment and key parameter
Thank you rvelices. I indeed find the key when first invoking the pwg.images.getInfo method.
Code:
<comment_post author="pierrick" key="1214743942:ba2ca26ec0245cfd7203db539fc084bc"/>
Don't we give here a perfect trick for spamers ?
(by the way, when I've asked the answer in PHP serialized format, I haven't been able to unserialize it, but it works on pwg.getVersion method)
Offline
#4 2008-06-30 10:17:35
- linuxlefty
- Member
- China
- 2008-04-13
- 65
Re: [webservice] pwg.images.addComment and key parameter
I know this is a little off topic, but seeing the value of the key got me thinking. It would be cool if PWG would interface with http://akismet.com/.
Hmm... I think I'll look into making a plugin :D
My website: http://www.LinuxLefty.com
Offline
#5 2008-06-30 11:10:06
- rvelices
- Former Piwigo Team
- 2005-12-29
- 1960
Re: [webservice] pwg.images.addComment and key parameter
linuxlefty wrote:
I know this is a little off topic, but seeing the value of the key got me thinking. It would be cool if PWG would interface with http://akismet.com/.
Hmm... I think I'll look into making a plugin :D
It's here :-)
Offline
#6 2008-06-30 13:42:37
- plg
- Piwigo Team
- Nantes, France, Europe
- 2002-04-05
- 14081
Re: [webservice] pwg.images.addComment and key parameter
Shouldn't we integrate Akismet in core plugins?
Offline
#7 2008-06-30 15:18:25
- rvelices
- Former Piwigo Team
- 2005-12-29
- 1960
Re: [webservice] pwg.images.addComment and key parameter
z0rglub wrote:
Shouldn't we integrate Akismet in core plugins?
Why not ? It is the only plugin that wordpress provides with its own install...
Regarding your previous question for spammers, I'm not sure we give them a trick here... I could write a lot about that, but today there are some intelligent spammers (fortunately not a lot!) that use a network of zombies (so IP based control does not work) and which retrieve the html page every time before posting a comment (and of course they post back the key). It's here when akismet comes in very handy. However many of them are stopped by the "key" we put on the page.
z0rglub wrote:
(by the way, when I've asked the answer in PHP serialized format, I haven't been able to unserialize it, but it works on pwg.getVersion method)
This is really odd as I'm using php serialize function. To my knowledege there is no object serialized so that's not an issue. The only thing that comes to my mind is character encoding, but even this should work and in worst case you'll have your accents lost
Offline