Deleting Trackbacks open to 'world'?

[TigerDuck]

Hi there ,

I receive trackback spam once in a while and my blog notifies me about a new trackback as it is configured to do.

Having a closer look at the notification e-mail and especially the link for deleting that specific trackback, I wonder if there is any security built in that classifies me as the administrator that is supposed to decide it that trackback should be deleted or not.
The link format is something like the following:
http://blog.url/delete/trackback/xx/yy- ... entry.html
where xx stands for the number of the trackback and yy for the number of the blog entry.

Wouldn't that enable 'world' to delete every single trackback on every s9y blog there is?

Any advice will be very much appreciated.

Regards
Ralf

[garvinhicking]

Hi!

That's a good oberservation. But don't be afraid, that link only works when you'relogged into your s9y and have a valid session cookie.

HTH,
Garvin

[koltregaskes]

Hi Garvin,

I've received some spam trackbacks recently. I've followed your instructions in a previous message to prevent it now but how do I go back and delete the ones that have already got through?

Kol

[koltregaskes]

Ignore me, I've finally found out how to.

Kol

[Garrett Albright]

I've got s9y set up so that all trackbacks have to be manually approved. Needless to say, the spam to legitimate trackback ratio is something like a hundred to one. Now if I don't want to approve the trackback, do I have to manually delete each one to remove it from the database, or are non-approved trackbacks automatically removed from the database after a certain amount of time?

[garvinhicking]

Hi Garrett!

As it currently stand, non-approved trackbacks stay in the database, so you would need to delete them from time to time. Either my filtering the comment moderation panel to show you 100 unapproved items, check the "invert selection" button and click on delete.

Or you do it via SQL:

Code: Select all

DELETE FROM serendipity_comments WHERE type = 'trackback' AND status = 'pending'

HTH,
Garvin