Starting discussions only with title can be spammy

res7art

I made permission to start discussion without approval only to Admin, but users/members can spam discussions only with Titles and without text (the discussion itslef) and it get's posted for some reason. It let's them bypass the approval and it can get spammy. I upload image here:

https://ibb.co/YTYFL38v

huseyinfiliz

res7art In a standard Flarum installation, the discussions API should return a "content field is required" error, and the discussion should not be created. Even an administrator should not be able to publish a discussion if the content field is empty.

It's likely that an extension or a modification you've made might be causing this. Therefore, if you provide the php flarum info output, it would help in diagnosing the problem.

res7art

huseyinfiliz Thank you for reply. It means alot to me. Since I'm not really a PHP coder, where can I show you the info output?

huseyinfiliz

res7art While it's generally explained at https://docs.flarum.org/console/, you can obtain this information by running the php flarum info command over SSH.

If this is not possible for you, you can provide your PHP version, Flarum version, and a list of the third-party extensions you are using.

res7art

huseyinfiliz I'm using many extension from FoF - Best Answers, Drafts, Links, Polls, Reactions, Upload, reCaptcha (reCaptcha is disabled on post. It's only enabled on sing in/up). For other third part extension I'm using Akismet for anti-spam and v17development/SEO extension.

I just tried to post a discussion title without text with the Admin account and it returned a "content field is required", but If a user/member does this, it gets bypassed.

Edit: I'm using PHP 8.3 and the latest flarum version - flarum-v1.x-no-public-dir-php8.3.zip

huseyinfiliz

res7art The Akismet extension is causing this issue.

Due to the Akismet settings bypassing administrators, while administrators cannot create discussions with empty content, members who are subject to Akismet checks can attempt to, which triggers the problem.

The akismet/src/Listener/ValidatePost.php file, when processing the incoming request, does not expect the content field to be empty (null) and throws a TypeError.

Interestingly, after this error occurs and you click 'share' again, the content is sent as \n instead of being truly empty, and Akismet approves it.

This is an interesting conflict/interaction, and I don't expect it to be fixed quickly. I recommend disabling this extension for now.

@SychO @luceos

res7art

huseyinfiliz Correct. It was the Akismet. Disabled it, and it worked. Strange.