Deleting Kareha board posts

This is how post deletion passwords are generated in Kareha (anonymous board software used by some boards (but not this site)):

function make_password()
{
var chars="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
var pass='';

for(var i=0;i<8;i++)
{
var rnd=Math.floor(Math.random()*chars.length);
pass+=chars.substring(rnd,rnd+1);
}

return(pass);
}

Every post has a post deletion password. If you know it (or can guess/brute force it), you can delete the post.
I haven't looked over all of the source code, but I wouldn't be surprised if there isn't any form of rate limiting, considering how primitive and kind of broken the software is, as is the case for many alternative image and text boards, especially those run by people who merely install the board software instead of writing it themselves (and usually have poor coding and security knowledge).

Here's how to delete a post:
function delete_post(thread,post,file)
{
if(confirm("Are you sure you want to delete reply "+post+"?"))
{
var fileonly=false;
var script=document.forms[0].action;
var password=document.forms[0].password.value;

if(file) fileonly=confirm("Leave the reply text and delete the only file?");

document.location=script
+"?task=delete"
+"&delete="+thread+","+post
+"&password="+password
+"&fileonly="+(fileonly?"1":"0");
}
}

The way to call the function is like this (as an example):
javascript:delete_post(1534535341,1) to delete an OP.
Or
javascript:delete_post(1534480288,79) to delete the 79th post in a thread. (the post number is a 32-bit unix time stamp)
I found a certain board that adds style="display:none;" to the deletion span element, but doesn't actually modify the board software in order to really remove it.


The function takes 3 arguments, and isn't overloaded, yet I see it being used with just 2 on a text board (because there is no image file associated with the post).
I'm sure you could automate this. Not that I'd advocate doing that, but I'm just saying.

I remember someone on /g/ made a script that would delete random imgur posts, before they changed how post deletion worked.

You could encode arbitrary HTML as a series of Perl

chr()

. For example, I made one poast with an embeded VIPSTAR autoplay.