Question

The background:
Ok, I run a legacy BBG over at ninjawars.net. There is an “attack” that players can make on other players that is initialized via form post. Essentially, we can simplify the situation to pretend that there’s a page, lets call it attack.php, with a giant “ATTACK” form post that submits to another php page, lets call it accept_attack.php, and the second page performs the attack functionality, lets say killing other player 1, 2, or 3.
The server runs PHP5, Postgresql, Apache

The problems:

• If I hit that big “ATTACK” button, and it brings me to the accept_attack.php, I can then hit refresh three times, resubmitting each time, to attack again three times in succession.
• If I open up three tabs of the first page, and hit attack on each page, I end up with three instantaneous attacks that kill players 1, 2, and 3 all at once, and I can just continually refresh to repeat.
• Despite my attempts to have a “most recent attack” timer that gets saved to the database, players seem to be able to work around it, perhaps just by refreshing three copied tabs in a synchronized enough way, so that they may all retrieve the same timer (e.g. 10:00:00:0000 am) and thus proceed with the resulting processing.

The solution needed:

So how do I prevent the same processing of a certain script from being preformed all at once in triplicate?

Php, Social engineering, and/or javascript/jQuery solutions preferred (probably in about that order).

Edit:
Based on the answers, here’s what I did to (potentially, before stress testing) solve it:
The session answer seemed simplest/most comprehensible to implement, so I used that data store. I tested it and it seems to work, but there may be ways around it that I’m not aware of.

$recent_attack = null;
$start_of_attack = microtime(true);
$attack_spacing = 0.2; // fraction of a second
if(SESSION::is_set('recent_attack')){
    $recent_attack = SESSION::get('recent_attack');
}

if($recent_attack && $recent_attack>($start_of_attack-$attack_spacing)){
    echo "<p>Even the best of ninjas cannot attack that quickly.</p>";
    echo "<a href='attack_player.php'>Return to combat</a>";
    SESSION::set('recent_attack', $start_of_attack);
    die();
} else {
    SESSION::set('recent_attack', $start_of_attack);
}

If there’re ways to improve on that or ways that that is exploitable (beyond the one obvious to me that echoing stuff isn’t a good seperation of logic, I’d love to know. Along those lines, community-wiki-ed.

Answer 1

Similar to Godeke’s solutions. Couldn’t you generate a token with a hidden field on the “Attack” button form and store that in a session? Then on the accept-attack.php page you would check if the $_POST[‘token’] == $_SESSION[‘token’].

so you would have something similar to this on the accept-attack.php page


if($_POST['token'] == $_SESSION['token']){

       echo 'no cheating!';
            // or redirect to the attach page
   }else{
         $_SESSION['token'] = $_POST['token'];
         // then perform the attack
   }