Strange, the spam keeps coming back for that one photo. I have checked it again, the captcha and akismet are both enabled. I can privately send the link if someone wants to investigate this, I am not going to link more to that photo.
Are you sure the SPAM is comming from posting to zenphoto? Change your Admin password. Maybe someone has figured out that code--it is used in encrypting the CAPTCHA data.
I'm quite sure it has to do with zenphoto, I can see it in the logs. Typical behavior is as follows: random URI has get request from an IP some other IPs get the URI as well followed by hosts that each do about 2 requests with POST and then disappear the strange thing is that akismet does not seem to catch any of those spam comments?
I did not get mod_security working to log the post parameters. I decided to try and give Mollom a shot, I now have that running. Plugin code is below, code is free to use under GPL license. It requires the PHP class from http://mollom.crsolutions.be/
And thanks for the great API, implementing this was very. I'll keep you updated with the results!
I am now wondering whether I will replace the regular captcha code with the mollom captcha. Might be interesting for other users too, but then the captcha code needs to be turned in a plugin as well.
<?php /** * This is a Mollom based SPAM filter. * It uses the Mollom service to check spam * * @author Bart Braem * @version 1.0.0 * @package plugins */
require 'mollom.php';
/** * This implements the standard SpamFilter class for the Simple spam filter. * */ class SpamFilter {
/** * The SpamFilter class instantiation function. * * @return SpamFilter */ function SpamFilter() { setOptionDefault('public_key', $this->publicKey); setOptionDefault('private_key', $this->privateKey); }
/** * The admin options interface * called from admin Options tab * returns an array of the option names the theme supports * the array is indexed by the option name. The value for each option is an array: * 'type' => 0 says for admin to use a standard textbox for the option * 'type' => 1 says for admin to use a standard checkbox for the option * 'type' => 2 will cause admin to call handleOption to generate the HTML for the option * 'desc' => text to be displayed for the option description. * * @return array */ function getOptionsSupported() { return array( gettext('Public Key') => array('key' => 'public_key', 'type' => 0, 'desc' => gettext('Mollom public key')), gettext('Private Key') => array('key' => 'private_key', 'type' => 0, 'desc' => gettext('Mollom private key')) ); }
/** * The function for processing a message to see if it might be SPAM * returns: * 0 if the message is SPAM * 1 if the message might be SPAM (it will be marked for moderation) * 2 if the message is not SPAM * * @param string $author Author field from the posting * @param string $email Email field from the posting * @param string $website Website field from the posting * @param string $body The text of the comment * @param string $imageLink A link to the album/image on which the post was made * @param string $ip the IP address of the comment poster * * @return int */ function filterMessage($author, $email, $website, $body, $imageLink, $ip) { // set keys Mollom::setPublicKey(getOption('public_key')); Mollom::setPrivateKey(getOption('private_key'));
I have also posted a ticket with the CAPTCHA generator code, the combination of both stops all spam here! Ticket is http://www.zenphoto.org/trac/ticket/920 Still needs works though, because an option to choose the CAPTCHA generator needs to be in place if you want to keep the current generator working.
Comments
Is the API to report akismet mistakes implemented?
random URI has get request from an IP
some other IPs get the URI as well
followed by hosts that each do about 2 requests with POST and then disappear
the strange thing is that akismet does not seem to catch any of those spam comments?
And thanks for the great API, implementing this was very. I'll keep you updated with the results!
I am now wondering whether I will replace the regular captcha code with the mollom captcha. Might be interesting for other users too, but then the captcha code needs to be turned in a plugin as well.
<?php
/**
* This is a Mollom based SPAM filter.
* It uses the Mollom service to check spam
*
* @author Bart Braem
* @version 1.0.0
* @package plugins
*/
require 'mollom.php';
/**
* This implements the standard SpamFilter class for the Simple spam filter.
*
*/
class SpamFilter {
/**
* The SpamFilter class instantiation function.
*
* @return SpamFilter
*/
function SpamFilter() {
setOptionDefault('public_key', $this->publicKey);
setOptionDefault('private_key', $this->privateKey);
}
/**
* The admin options interface
* called from admin Options tab
* returns an array of the option names the theme supports
* the array is indexed by the option name. The value for each option is an array:
* 'type' => 0 says for admin to use a standard textbox for the option
* 'type' => 1 says for admin to use a standard checkbox for the option
* 'type' => 2 will cause admin to call handleOption to generate the HTML for the option
* 'desc' => text to be displayed for the option description.
*
* @return array
*/
function getOptionsSupported() {
return array(
gettext('Public Key') => array('key' => 'public_key', 'type' => 0, 'desc' => gettext('Mollom public key')),
gettext('Private Key') => array('key' => 'private_key', 'type' => 0, 'desc' => gettext('Mollom private key'))
);
}
/**
* The function for processing a message to see if it might be SPAM
* returns:
* 0 if the message is SPAM
* 1 if the message might be SPAM (it will be marked for moderation)
* 2 if the message is not SPAM
*
* @param string $author Author field from the posting
* @param string $email Email field from the posting
* @param string $website Website field from the posting
* @param string $body The text of the comment
* @param string $imageLink A link to the album/image on which the post was made
* @param string $ip the IP address of the comment poster
*
* @return int
*/
function filterMessage($author, $email, $website, $body, $imageLink, $ip) {
// set keys
Mollom::setPublicKey(getOption('public_key'));
Mollom::setPrivateKey(getOption('private_key'));
$servers = Mollom::getServerList();
Mollom::setServerList($servers);
// get feedback
try
{
$feedback = Mollom::checkContent(null, null, $body, $author, $website, $email);
}
catch (Exception $e)
{
// mark comment for moderation, Mollom is acting strange
}
// process feedback
if(in_array($feedback['spam'], array('unsure', 'unknow')))
{
$result = 1;
}
elseif ($feedback['spam'] == 'ham') $result = 2;
elseif ($feedback['spam'] == 'spam') $result = 0;
return $result;
}
}
?>
I will be posting mollom based CAPTCHA code too, it keeps my site spamfree at this moment (but comments continue to work). Which is how I like it.
Still needs works though, because an option to choose the CAPTCHA generator needs to be in place if you want to keep the current generator working.