Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #27078

Re: onclick and <a> tag question

Show key headers only | View raw

Thomas Lahn said:

> _attribute_.  And why the emphasis?  Do you want a pat on the back for not
> doing mindbogglingly stupid things?

    I normally like 'pats-on-the-back' if the patter is not holding a knife 
in that hand  :)

>
>>     I have determined that on IE8 (at least) that the onclick operation
>> occurs first and then the 'download' operation follows after the chkdld()
>> function returns either a true or false.
>
> You want to test with modern browsers first.  And nothing is returned 
> here.
>
>> Question:
>>
>>     Is this sequence (i.e., 'onclick' followed by 'download operation')
>> generally true across most all current common browsers. ??
>
> Yes, to all script-supporting browsers worth their salt.  The download is
> only a consequence of the default action for links when the browser has
> determined that it cannot reasonably navigate to and display the resource,
> or if response header or the user said that they always want to download
> such resources.  You can cancel the default action of the "click" event by
> returning "false" to the event handler; in this case, as is recommended, 
> by
> returning the return value of a function or method:
>
>  <a href="." onclick="return chkdld(this)">.</a>
>

    Understood. I'll try this today

    I would expect the abusers (who I believe play 'nice' from their home 
machines, but use proxies when they put on their 'black hats') may have JS 
disabled on their proxies, so I have to check for this too before anything 
else.

>> Reason:
>>
>>     I hope to use the 'onclick' sequence to start up an Ajax operation to
>> determine the IP address info of the user, and then send a text response
>> to modify the 'files' sub-directory to point to the *actual* download
>> sub-dir -- which I modify frequently.
>
> You do not want to do that.  Doing so could be considered forgery; it will
> not help, and may hinder, your good standing with search engines.  For
> forgery aside, the search engine will probably not be able to detect 
> whether
> this part of your site was updated.  As a rule of thumb, search engines
> "like" sites whose content (not: URIs) is frequently updated.
>

    My site is frequently updated -- usually weekly.  My users are 
usually/mostly/only C programmers. who visit to pick upthe latest 'builds'.
    I don't wish to encourage casual browsers from visiting and don't care 
about search engines for my site, and wish to actively discourage 'abusers' 
.

>> Recently, on request I've eliminated use of passwords and, instead, am
>> keeping a database of  'abusers' of my free service who typically start 
>> up
>> dozens of simultaneous downloads to try to overwhelm my server.  Because
>> my actual download sub-dir changes frequently,
>  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Bad idea.  <http://www.w3.org/QA/Tips/uri-choose>
>
>> I thought I could use Ajax to send the *actual* 'files' sub-dir as a
>> response at thelast moment, then perhaps I could (somehow) revert it
>> later after the download is started -- but I don't know how to do this 
>> yet
>> (i.e., the 'reverting').

    My intent is to force users to actually 'click' on the download anchor 
rather than using automated 'Gets' via Curl or other methods of automating 
downloads. My downloads range in size from 14Meg thru 29Meg, and some 
'abusers' start up 25-50 downloads simultaneously, then '206' then and let 
some continue.  But if I force the downloader to actually 'click' on the 
file, this may discourage them from 'practicing on me and my small home 
office site. Maybe !

>
> It is pointless to try and hide content from abusers this way.  It is like
> trying to scare burglars away by locking the door of your house and 
> hanging
> up outside a sign with a large red down arrow that says "The key for this
> door is right below your feet, under the mat."
>
> Get a bigger house (better hosting space) or a watchdog instead (detect
> abusers by their connection data and request headers, and tell them 403).

Thanks for the response and for the advice

-Mel Smith

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

onclick and <a> tag question "Mel Smith" <syntel@cox.net> - 2015-03-18 16:44 -0700
  Re: onclick and <a> tag question Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-19 03:47 +0100
    Re: onclick and <a> tag question "Mel Smith" <syntel@cox.net> - 2015-03-19 08:54 -0700
      Re: onclick and <a> tag question "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-19 18:29 +0100
        Re: onclick and <a> tag question "Mel Smith" <syntel@cox.net> - 2015-03-19 12:29 -0700
          Re: onclick and <a> tag question "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-19 21:29 +0100
            Re: onclick and <a> tag question "Mel Smith" <syntel@cox.net> - 2015-03-19 16:34 -0700
              Re: onclick and <a> tag question "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-20 01:28 +0100
                Re: onclick and <a> tag question "Mel Smith" <syntel@cox.net> - 2015-03-19 21:42 -0700
              Re: onclick and <a> tag question Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-20 12:30 +0100
                Re: onclick and <a> tag question "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-03-20 13:51 +0100

csiph-web