IvorD Posted August 21, 2020 Report Share Posted August 21, 2020 I asked a similar question back in 2019 on the Off Topic forum, but got no response and the problem has now cropped up again: We got alerted through the Google Search Console about a "bad" link on our website. The link cited was a Revive ad link in which a different URL from the target URL of the bannerid banner had been substituted for the oadest component of oaparams The substituted URLs are to porn sites, of course. Curiously, going through the last couple of months of Apache logs, I can only find requests for lots of similarly hijacked URLs (for the same banner and zone IDs) from web crawlers, primarily Google. I find no requests from any website where the crawlers may have found the links, so I have no idea where the search engines found them to try to crawl them through our site. I've compared the live Revive installation with a separate development server and have concluded that none of the source files has been corrupted and none of the banners in the database has been corrupted. Specific questions: Has anyone else experienced and/or investigated this problem and, if so, how did you avoid it? I've seen references to "features" that require the presence the oadest URL parameter when one would think that the bannerid and zoneid should be sufficient. Where can I find an explanation of those "features" and why this security hole is "unavoidable". Perhaps I can join the club of those who have banged their heads on the wall looking for a solution to the oadest problem, given a pointer to the context. Quote Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.