5
Quote:
petzan wrote:
But, if my site is on internet I can not trust all visitors. So could this change make it possible for anonymous (not logged in) users to harm my site?
anonymous or logged in - they both have to live under the same rules regarding the database.
The Referrer-check checks if form requests came from the webserver. If you disable the check, you cannot be certain that visitors aren't making their own versions of forms and send them via the POST method. This could leave your site open for e.g. SQL injection from custom made forms.
I use a custom form for accessing an email account - which makes life easier for me, but it might be possible to exploit that (I just don't)
