New spam blocking method for trackbacks: ip validation. The senders ip is compared with the ip of the host, the trackback is set to. If they don't match, the trackback is rejected/moderated. This should reject most of the trackback spam bots.
This commit is contained in:
Grischa Brockhaus
parent
bde584609d
commit
fc1e6a049f
docs
plugins/serendipity_event_spamblock
@ -3,6 +3,11 @@
|
||||
Version 1.3 ()
|
||||
------------------------------------------------------------------------
|
||||
|
||||
* New spam blocking method for trackbacks: ip validation. The
|
||||
senders ip is compared with the ip of the host, the trackback is
|
||||
set to. If they don't match, the trackback is rejected/moderated.
|
||||
This should reject most of the trackback spam bots. (brockhaus)
|
||||
|
||||
* The recent entries sidebar plugin shiped with s9y listed entries
|
||||
not accessable by the current user because of right restrictions.
|
||||
(brockhaus)
|
||||
|
||||
@ -105,4 +105,15 @@
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF', 'CSRF-Schutz aktivieren?');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_DESC', 'Falls aktiviert, wird ein spezieller Hash-Wert sicherstellen, dass nur Benutzer Kommentare hinterlassen dürfen , die eine gültige Session-ID haben. Dies wird Spam etwas eindämmen und es unmöglich machen, dass Sie ungewollt Kommentare via CSRF-Angriffen hinterlassen, aber es wird auch dazu führen dass nur Benutzer mit aktivierten Cookies kommentieren können.');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_REASON', 'Ihr Kommentar enthielt keinen gültigen Session-Hash. Kommentare auf diesem Blog können nur mit aktivierten Cookies hinterlassen werden!');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_REASON', 'Ihr Kommentar enthielt keinen gültigen Session-Hash. Kommentare auf diesem Blog können nur mit aktivierten Cookies hinterlassen werden!');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS', 'SPAM IP Adressen via HTaccess blocken?');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS_DESC', 'Wenn Sie diese Option einschalten, dann werden IPs von denen SPAM gesendet wurde zu Ihref .htacces Datei hinzu gefügt. Die .htaccess Datei wird regelmässig mit den abgelehnten IPs des letzten Monats erneuert.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_LOOK', 'So sehen Ihre Captchas im Moment aus. Nachdem Sie die Einstellungen geändert und gespeichert haben können Sie durch einen Klick auf diese das Aussehen hier erneuern.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION', 'Trackback IP Validierung');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION_DESC', 'Soll die IP des Trackback Senders mit der IP des Hosts übereinstimmen, auf den der Trackback gesetzt werden soll? (EMPFOHLEN!)');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION', 'Trackback IP Validierung : %s [%s] != Sender IP [%s]');
|
||||
|
||||
?>
|
||||
|
||||
@ -105,4 +105,15 @@
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF', 'CSRF-Schutz aktivieren?');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_DESC', 'Falls aktiviert, wird ein spezieller Hash-Wert sicherstellen, dass nur Benutzer Kommentare hinterlassen dürfen , die eine gültige Session-ID haben. Dies wird Spam etwas eindämmen und es unmöglich machen, dass Sie ungewollt Kommentare via CSRF-Angriffen hinterlassen, aber es wird auch dazu führen dass nur Benutzer mit aktivierten Cookies kommentieren können.');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_REASON', 'Ihr Kommentar enthielt keinen gültigen Session-Hash. Kommentare auf diesem Blog können nur mit aktivierten Cookies hinterlassen werden!');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_CSRF_REASON', 'Ihr Kommentar enthielt keinen gültigen Session-Hash. Kommentare auf diesem Blog können nur mit aktivierten Cookies hinterlassen werden!');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS', 'SPAM IP Adressen via HTaccess blocken?');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS_DESC', 'Wenn Sie diese Option einschalten, dann werden IPs von denen SPAM gesendet wurde zu Ihref .htacces Datei hinzu gefügt. Die .htaccess Datei wird regelmässig mit den abgelehnten IPs des letzten Monats erneuert.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_LOOK', 'So sehen Ihre Captchas im Moment aus. Nachdem Sie die Einstellungen geändert und gespeichert haben können Sie durch einen Klick auf diese das Aussehen hier erneuern.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION', 'Trackback IP Validierung');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION_DESC', 'Soll die IP des Trackback Senders mit der IP des Hosts übereinstimmen, auf den der Trackback gesetzt werden soll? (EMPFOHLEN!)');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION', 'Trackback IP Validierung : %s [%s] != Sender IP [%s]');
|
||||
|
||||
?>
|
||||
|
||||
@ -122,4 +122,10 @@
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS', 'Block bad IPs via HTaccess?');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_HTACCESS_DESC', 'Enabling this will add IPs that have sent spam to your blog to your .htaccess file. The .htaccess file will be regenerated regularly with the forbidden IPs of the last month.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_LOOK', 'This is how your captcha images currently look like. If you changed and saved settings above and want to refresh the look of your captcha, simply click on it to reload.');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_LOOK', 'This is how your captcha images currently look like. If you changed and saved settings above and want to refresh the look of your captcha, simply click on it to reload.');
|
||||
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION', 'Trackback ip validation');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION_DESC', 'Should the IP of the sender match the IP of the host, a trackback is set to? (RECOMMENDED!)');
|
||||
@define('PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION', 'Trackback ip validation: %s [%s] != sender ip [%s]');
|
||||
|
||||
?>
|
||||
|
||||
@ -33,13 +33,13 @@ var $filter_defaults;
|
||||
$propbag->add('name', PLUGIN_EVENT_SPAMBLOCK_TITLE);
|
||||
$propbag->add('description', PLUGIN_EVENT_SPAMBLOCK_DESC);
|
||||
$propbag->add('stackable', false);
|
||||
$propbag->add('author', 'Garvin Hicking, Sebastian Nohn');
|
||||
$propbag->add('author', 'Garvin Hicking, Sebastian Nohn, Grischa Brockhaus');
|
||||
$propbag->add('requirements', array(
|
||||
'serendipity' => '0.8',
|
||||
'smarty' => '2.6.7',
|
||||
'php' => '4.1.0'
|
||||
));
|
||||
$propbag->add('version', '1.68');
|
||||
$propbag->add('version', '1.69');
|
||||
$propbag->add('event_hooks', array(
|
||||
'frontend_saveComment' => true,
|
||||
'external_plugin' => true,
|
||||
@ -51,6 +51,7 @@ var $filter_defaults;
|
||||
$propbag->add('configuration', array(
|
||||
'killswitch',
|
||||
'hide_for_authors',
|
||||
'trackback_ipvalidation' ,
|
||||
'bodyclone',
|
||||
'entrytitle',
|
||||
'ipflood',
|
||||
@ -108,6 +109,25 @@ var $filter_defaults;
|
||||
|
||||
break;
|
||||
|
||||
case 'trackback_ipvalidation':
|
||||
/*
|
||||
$propbag->add('type', 'boolean');
|
||||
$propbag->add('name', PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION);
|
||||
$propbag->add('description', PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION_DESC);
|
||||
$propbag->add('default', false);
|
||||
*/
|
||||
|
||||
$propbag->add('type', 'radio');
|
||||
$propbag->add('name', PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION);
|
||||
$propbag->add('description', PLUGIN_EVENT_SPAMBLOCK_TRACKBACKIPVALIDATION_DESC);
|
||||
$propbag->add('default', 'no');
|
||||
$propbag->add('radio', array(
|
||||
'value' => array('no', 'moderate', 'reject'),
|
||||
'desc' => array(NO, PLUGIN_EVENT_SPAMBLOCK_API_MODERATE, PLUGIN_EVENT_SPAMBLOCK_API_REJECT)
|
||||
));
|
||||
$propbag->add('radio_per_row', '1');
|
||||
break;
|
||||
|
||||
case 'trackback_check_url':
|
||||
$propbag->add('type', 'boolean');
|
||||
$propbag->add('name', PLUGIN_EVENT_SPAMBLOCK_TRACKBACKURL);
|
||||
@ -671,6 +691,7 @@ var $filter_defaults;
|
||||
|
||||
function event_hook($event, &$bag, &$eventData, $addData = null) {
|
||||
global $serendipity;
|
||||
$debug = true;
|
||||
|
||||
$hooks = &$bag->get('event_hooks');
|
||||
|
||||
@ -794,6 +815,43 @@ var $filter_defaults;
|
||||
}
|
||||
}
|
||||
|
||||
// Check if sender ip is matching trackback ip (ip validation)
|
||||
$trackback_ipvalidation_option = $this->get_config('trackback_ipvalidation','no');
|
||||
if ($addData['type'] == 'TRACKBACK' && $trackback_ipvalidation_option != 'no') {
|
||||
$this->IsHardcoreSpammer();
|
||||
$parts = @parse_url($addData['url']);
|
||||
$tipval_method = ($trackback_ipvalidation_option == 'reject'?'REJECTED':'MODERATE');
|
||||
// Getting host from url successfully?
|
||||
if (!is_array($parts)) { // not a valid URL
|
||||
$this->log($logfile, $eventData['id'], $tipval_method, sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $addData['url'], '', ''));
|
||||
if ($trackback_ipvalidation_option == 'reject') {
|
||||
$eventData = array('allow_comments' => false);
|
||||
$serendipity['messagestack']['comments'][] = sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $addData['url']);
|
||||
return false;
|
||||
} else {
|
||||
$eventData['moderate_comments'] = true;
|
||||
$serendipity['csuccess'] = 'moderate';
|
||||
$serendipity['moderate_reason'] = sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $addData['url']);
|
||||
}
|
||||
}
|
||||
$trackback_ip = preg_replace('/[^0-9.]/', '', gethostbyname($parts['host']) );
|
||||
$sender_ip = preg_replace('/[^0-9.]/', '', $_SERVER['REMOTE_ADDR'] );
|
||||
$sender_ua = ($debug ? ', ua="' . $_SERVER['HTTP_USER_AGENT'] . '"' : '') ;
|
||||
// Is host ip and sender ip matching?
|
||||
if ($trackback_ip != $sender_ip) {
|
||||
$this->log($logfile, $eventData['id'], $tipval_method, sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $parts['host'], $trackback_ip, $sender_ip . $sender_ua), $addData);
|
||||
if ($trackback_ipvalidation_option == 'reject') {
|
||||
$eventData = array('allow_comments' => false);
|
||||
$serendipity['messagestack']['comments'][] = sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $parts['host'], $trackback_ip, $sender_ip . $sender_ua);
|
||||
return false;
|
||||
} else {
|
||||
$eventData['moderate_comments'] = true;
|
||||
$serendipity['csuccess'] = 'moderate';
|
||||
$serendipity['moderate_reason'] = sprintf(PLUGIN_EVENT_SPAMBLOCK_REASON_IPVALIDATION, $parts['host'], $trackback_ip, $sender_ip . $sender_ua);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Filter Akismet Blacklist?
|
||||
$akismet_apikey = $this->get_config('akismet');
|
||||
$akismet = $this->get_config('akismet_filter');
|
||||
@ -995,7 +1053,7 @@ var $filter_defaults;
|
||||
// $this->log($logfile, $eventData['id'], 'REJECTED', 'Captcha not needed: ' . $serendipity['POST']['captcha'] . ' / ' . $_SESSION['spamblock']['captcha'] . ' // Source: ' . $_SERVER['REQUEST_URI'], $addData);
|
||||
}
|
||||
|
||||
// Check for forced comment moderation
|
||||
// Check for forced comment moderation (X days)
|
||||
if ($addData['type'] == 'NORMAL' && $forcemoderation > 0 && $eventData['timestamp'] < (time() - ($forcemoderation * 60 * 60 * 24))) {
|
||||
$this->log($logfile, $eventData['id'], $forcemoderation_treat, PLUGIN_EVENT_SPAMBLOCK_REASON_FORCEMODERATION, $addData);
|
||||
if ($forcemoderation_treat == 'reject') {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user