Plone seach view and context

hvelarde · September 1, 2015, 5:01pm

is there any reason to have the search view registered for all interfaces instead of the site root only?

plone/plone.app.search/blob/master/plone/app/search/configure.zcml

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:five="http://namespaces.zope.org/five"
    xmlns:browser="http://namespaces.zope.org/browser"
    xmlns:genericsetup="http://namespaces.zope.org/genericsetup"
    i18n_domain="plone">

   <genericsetup:registerProfile
       name="default"
       title="Plone's Advanced Search Form"
       description="Dynamic, ajax-driven search results view with filtering and sorting support."
       directory="profiles/default"
       provides="Products.GenericSetup.interfaces.EXTENSION"
       />

    <browser:resource
        name="search.js"
        file="search.js"
        />

This file has been truncated. show original

IMO, this is a potential target for DDoS attacks.

also, I don't see this package pinned for Plone 5.0; are we missing it?

pbauer · September 1, 2015, 5:15pm

In Plone 5 the code is part of Products.CMFPlone. Why do you think that is a possible DDOS-vector?

vangheem · September 1, 2015, 5:15pm

Perhaps it should be registered against INavigationRoot?

zopyx · September 1, 2015, 5:34pm

It's a common usecase to provide an extended search form for a subtree of the site where the search root must not necessarily have INavigationRoot set. Leave it as it is.

-aj

hvelarde · September 1, 2015, 5:51pm

In the past we have seen DDoS attacks on some of our sites using the search form; the search form is difficult to protect besides some sort of rate limiting.

hvelarde · September 1, 2015, 5:51pm

Then maybe I need to override this only for us.

vangheem · September 1, 2015, 6:05pm

Any un-cached page on any web application can be used as a DDOS. You need other precautions in place in order to protect your site like WAF, failover, serve stale cache, cache pinning, etc.

If you have a particular site that is a target, I suggest you use something like collective.elasticindex and use js to return search results so it doesn't actually ever hit your site.

hvelarde · September 1, 2015, 6:46pm

I'm evaluating that, thanks!