Spam prevention

luceos · 2022-09-01T18:42:26+00:00

Spam prevention is an extension based on our spam fighting experience on the official Flarum community Discuss. After installation it does a great job at preventing any form of unwanted spam. Give it a spin if spam is an annoyance on your community! Requirements flarum/approval - this is required flarum/flags - this is recommended fof/spamblock - optional, when enabled immediately deletes users that open discussions with spam subjects Installation composer require blomstra/spam-prevention if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Now enable this extension from your admin area and it will already do its job. No further configuration needed. That's it. Read below what this package does and how to customize its behavior. Spam prevent logic How does it try to identify spam? it scans for phone numbers it scans for email addresses it scans for links that aren't in the allow list it identifies the language used against the language packs installed it ignores elevated users (mods and admins) Where does it scan for spam? it scans (first) posts it scans user bio's How does it take action? it flags posts with flarum/flags enabled it marks posts as not approved with flarum/approval enabled it overwrites user bio's if it identifies spam it marks users as spammer if a discussion subject contains spam with fof/spamblock Customization allowLinksFromDomain('luceos.com') // or just a full domain with protocol, only the host name is used ->allowLinksFromDomain('http://flarum.org') // even a link works, only the domain will be used ->allowLinksFromDomain('discuss.flarum.org/d/26095') // Alternatively, use an array of domains ->allowLinksFromDomains([ 'luceos.com', 'flarum.org', 'discuss.flarum.org' ]) // Use custom (expert) logic. // Return true to ignore further checking this link for validity. ->allowLink(function (Uri $uri, User $actor = null) { if ($uri->getHost() === '127.0.0.1') return true; }) // How long after sign up all posts are scrutinized for bad content ->checkForUserUpToHoursSinceSignUp(5) // How many of the first posts of a user to scrutinize for bad content ->checkForUserUpToPostContribution(5) // Specify the user Id of the moderator raising flags for some actions, otherwise the first admin is used ->moderateAsUser(2) // Disable specific spam prevention components ->disable(\Blomstra\Spam\Filters\UserBio::class), ]; if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } FAQ Why is there no admin settings page? Building a ux for an extension takes a lot of time, especially when the code isn't mature enough. Changes to the inner workings might affect a settings page countless times. We will build a settings page once we're satisfied about the features contained in this tool. Blomstra provides managed Flarum hosting and development. https://blomstra.net https://blomstra.community/t/ext-spam-prevention https://github.com/blomstra/flarum-ext-spam-prevention

luceos

Darkle I don't have a clue what exactly they scan and what not 🙈 But they probably do have some blocklist for emails and potentially mark certain domains as potential senders of spam.

Darkle

This works really well, it has already caught his first two spam discussions, I really appreciate the effort @luceos!

luceos

Darkle 🥳

Discuss has been running with this (and some other minor customizations like truncating the testing tag and refusing other tags in testing) for quite a while. We've fine tuned spam prevention to reduce the necessary effort with moderation. I will do my best to improve the extension based on our experiences here on discuss and our experiences on our managed hosting. I'm glad that more people can finally use something so powerful, yet simple.

pkernstock

Thanks @luceos for all the efforts your putting in the flarum ecosystem! Great to see Flarum evolving and getting better and better with each release.

I had to deal with some automated in Chinese language recently, so that extension comes with right timing. But I'm just wondering about one thing for now - taking your example:

->allowLinksFromDomain('luceos.com')

Does that also include the subdomain?

My intention is to whitelist "github.io" and all its subdomains. Is wildcard support possible?

luceos

pkernstock Does that also include the subdomain?

Yes.

pkernstock My intention is to whitelist "github.io" and all its subdomains. Is wildcard support possible?

No need. Just provide the domain and all subdomains are automatically allowed as well. Only if you use a sub domain will this be an exact match with the subdomain.

hey.luceos.com will only allow links from hey.luceos.com and any sub domains like wow.hey.luceos.com.
luceos.com will allow links from all sub domains, including hey.luceos.com and wow.hey.luceos.com

Darkle

luceos I would say that this doesn't work this way with the domain array option (allowLinksFromDomains), I don't know if this is intentional, but I would like to confirm it with another domain to be sure.

I noticed that youtube.com always redirects to www.youtube.com so even if the user types youtube.com the embedding redirects to www.youtube.com anyway, and with the array I had to put www as well so it could be detected properly.

luceos

Darkle stop finding bugs already 😂 Will look into that.

First test result is that deeply nested subdomains don't match, but subdomains do. At least according to the regex test, now I need to confirm check whether the code injects the domain correctly.

Darkle

luceos Haha sorry! I'll try again and confirm it, as it was one of the first domains I added, sometimes it took a while to refresh the new ones from extend.php, maybe that was the reason.

Darkle

I see what happens, if you post only the link (even if it's allowed) in the whole message the post is detected as spam, adding some text apart from the link does not detect it as such, so I was wrong, it does work automatically for subdomains with the array, sorry for the confusion.

This would be a different topic, maybe an option to allow posts that contain just a link if it's within the allowed ones?

luceos

I've published v1.1 with a few changes/fixes:

the domain regex would allow any character as subdomain, where it should check for a literal dot .
the domain regex would not allow any deeper nested subdomains
the site url is now properly added to the allow list, a test has been created to confirm

Please give this a spin @Darkle. I think youtube should work though, tests even seem to imply that. If not I'll need your configuration and the string to test (feel free to PR that if you want, there's a special UniqueExamplesTest to confirm workings of real world scenarios).

Darkle

luceos I've tried v1.1 it works fine, I've done some experiments with my own domain and everything's cool it detects it, I'm not sure if you saw this previous message (Darkle ), I think we published it almost at the same time, it's working with youtube the reason turned out to be a different one.

luceos

Tagged v1.2 which allows elevated users (mods and admins) to post without being hampered by the restriction this extension adds, will deploy to Discuss in a bit. (done)

Justoverclock

in these days flarum.it is literally assaulted from spammers, there's a way with this extension to create a button into the "post approval" modal that

spuspend users
delete all users post at once
ban ip

because now i need to delete manually each post created (a lot sometimes)

luceos

Justoverclock something like that would be interesting. Once I sit down for another update on this extension I will consider adding it. In the meantime PR's are welcome 😉

CyberGene

Justoverclock isn't the FoF Spamblock working similarly to what you suggest?

luceos

CyberGene it is, but it requires you to go into the user profile first.. I think @Justoverclock is trying to figure out how to further reduce the weight of moderation when seeing loads of spam.

Justoverclock

luceos exactly

MarkoK

Justoverclock I've had same issues on flarum.fi and Mass Actions helps with message deletion. Users must be deleted one by one still.

Justoverclock

MarkoK yes this is for sure an options, but what i mean is to have a single action from admin and mod to completely clean, ban and suspend user

MikeJones

Justoverclock yes this is for sure an options, but what i mean is to have a single action from admin and mod to completely clean, ban and suspend user

this would be amazing!

Post approval is blocking spam for me great! But man its becoming a pain to mark the user as spam then delete the all the posts as well. I 100% here you!

« Previous Page Next Page »