Re: [Postfixadmin-devel] Request for help to create bulk email address

[Christian B. <pos...@cb...>]

Hello,

Am Mittwoch, 28. Dezember 2011 schrieben Sie:
> Whats about saving the validated csv To a tmp dir in fs. In the next
> step the csv Form the Fa is processed. 

That would work (given we have a writeable tempdir, find a non-
conflicting filename, ...)

In other words: storing everything in the session is easier ;-)

_if_ the session explodes one day, we can change it - but until then, we 
can use the easy solution.

> For more security wie can add
> some security tokens to forms.

Well, a token might make sense - not security wise, but to avoid 
conflicts if a user opens two tabs and uses the bulk creation in both 
tabs in parallel. (Users sometimes have creative ideas...)
Especially if we support resuming after max_execution_time timeouts etc.


slightly OT: A token might really make sense in the login form, and we 
should also include the session id as hidden field to verify that the 
browser accepts cookies.


Regards,

Christian Boltz
-- 
Ich habe da eine Theorie: Betriebssysteme melden Fehler und wollen,
dass sie behoben werden. Bei Systemen wie Windows 9x sind die Fehler
wesentlicher Bestandteil und kein Grund, sich Sorgen zu machen.
[Steffen Lauterkorn in suse-linux]