posts/3rd-post/

[giscus[bot]]

posts/3rd-post/

This is the 3rd post for you.

http://localhost:4000/posts/3rd-post/

[ghost]

test

[laymonage]

@Sorlio Please do not use this repository for testing your project. How did you manage to do this anyway? We've put a lot of safeguarding against this. I guess unless you send a POST request directly to the API and pretend you're from the giscus.app website...

[ghost]

How did you manage to do this anyway?

Hi @laymonage, sorry for all the spam comments I've inadvertently posted, and now provide you with the process to achieve these actions:

1. I cloned someone's repository
2. I ran his repository site locally and then tested it by sending comments to the local site http://localhost:9000/
3. That repository uses the following giscus configuration:

const loadGiscus = () => {
  const config = Object.assign(
    {
      src: 'https://giscus.app/client.js',
      'data-repo': 'walefall/walefall.github.io',
      'data-repo-id': 'MDEwOlJlcG9zaXRvcnkzNTE5NTgwNTM=',
      'data-category-id': 'MDE4OkRpc2N1c3Npb25DYXRlZ29yeTMyNzk2NTc1',
      'data-theme': getGiscusTheme(document.documentElement.getAttribute('data-theme')),
      'data-reactions-enabled': '1',
      crossorigin: 'anonymous',
      async: true,
    },
    {
      'data-lang': 'zh-CN',
      'data-mapping': 'og:title',
      'data-category': 'General',
      'data-input-position': 'top',
    }
  );

  const ele = document.createElement('script');
  for (let key in config) {
    ele.setAttribute(key, config[key]);
  }
  document.getElementById('giscus-wrap').appendChild(ele);
};

4. and then all these bad things happened, the comments were all created under the giscus repository.

I'm not sure why comments are sent to this repository, is it because of the wrong data-repo-id?

[ghost]

@laymonage Once again, I apologize for my stupidity and ask you to DELETE the following invalid discussions:

• posts/3rd-post/ #1452
• posts/3rd-post/ #1453
• undefined #1455
• undefined #1456
• undefined #1457
• 注意力机制 #1458

[ghost]

I'm not sure why comments are sent to this repository, is it because of the wrong data-repo-id?

After my inspection, it is confirmed that the above repository (walefall/walefall.github.io) has indeed copied the data-repo-id and data-category-id from the giscus repository.

Perhaps we need additional mechanisms, such as checking whether the data-repo is bound to the data-repo-id. If not, the giscus UI component should not respond. This way, we can prevent others from using our data-repo-id.