Warning: mysqli::__construct(): (HY000/1203): User howardkn already has more than 'max_user_connections' active connections in D:\Inetpub\vhosts\howardknight.net\al.howardknight.net\includes\artfuncs.php on line 21
Failed to connect to MySQL: (1203) User howardkn already has more than 'max_user_connections' active connectionsPath: ...!3.us.feeder.erje.net!3.eu.feeder.erje.net!feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!Zx7D/NYItFLykhxJSZ3Jrw.user.46.165.242.91.POSTED!not-for-mail
From: Franck
Newsgroups: fr.comp.usenet.serveurs
Subject: Re: usage de cancel-clock
Date: Sat, 10 Sep 2022 09:03:37 +0200
Organization: Aioe.org NNTP Server
Message-ID:
References:
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Info: gioia.aioe.org; logging-data="10128"; posting-host="Zx7D/NYItFLykhxJSZ3Jrw.user.gioia.aioe.org"; mail-complaints-to="abuse@aioe.org";
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
Gecko/20100101 Thunderbird/102.2.2
Content-Language: fr
X-Notice: Filtered by postfilter v. 0.9.2
Bytes: 2143
Lines: 26
Le 10/09/2022 à 08:38, Marc SCHAEFER a écrit :
> En fait, je crois que c'est Frank qui a fait l'explication la plus
> complète. Typiquement, dans mon serveur, je ne différencie pas la clé de
> suppression admin de celle de suppression de l'utilisateur.
Ne pas faire de différence est contraire à la RFC qui stipule :
If the poster or posting agent doesn't add a Cancel-Lock header field
to a proto-article, then an injecting agent (or moderator) MAY add
one, including one or more elements.
If multiple elements are added to the Cancel-Lock header
field by a single agent, each element MUST use a unique
key "K" to improve security.
C'est le MUST qui l'impose!
Dans le cas d'un post, le serveur va ajouter plusieurs CLock
(User/Admin, généralement en SHA1 et SHA256) donc 4 CL.
Il faut donc différencier le secret admin et le secret utilisateur.