0

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away.

Instead of forcing them to create an account and take control of the node, I want to just give a use-ajax link that deletes the node. The $_SESSION variable would have the NID and the code to print the link would check for that.

To add some semblence of security, I'm thinking of adding the timestamp in the link and my module only deletes the node if the timestamp matches.

Is that secure enough? The same content type will be used by logged in users so it has to be fool-proof.

  • 2
    Whether it's eventually "secure enough" is up to you and your specific requirements, really, but just adding a timestamp doesn't represent any security at all IMO; brute force attacks would be trivial, an attacker would be able to exploit it in minutes, maybe less. You might consider HMACing the session variable, preferably with some more variables for entropy, that would at least give you some sort of cryptographic integrity. Or consider a different secure digest method. You're not really in the realms of Drupal, though, this is all general development/php stuff – Clive Sep 15 '17 at 8:59
  • Hmm, the nodes are just study materials created by teachers but I suppose a competing website or angry student might like to delete my nodes, so I will look at and add some cryptography. This is new territory for me. Thanks! – Niall Murphy Sep 15 '17 at 9:17
  • On second thought, I'll have my code flag the node for deletion instead of deleting it straight away since I'm new to this stuff. Thanks Clive. – Niall Murphy Sep 15 '17 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.