• Ok i just installed two fresh WordPress (1.3) blogs and without announcing them to whomever, i got casino spam out of nowhere (although notices of posts are send to pingomatic.com as per options/writing)
    A simple solution is to alter the post-form-process by editing two lines in two php files. This will definitely make spam-comment-bot’s life uneasy ??
    Bots tend to post data and not submit a form, so… generate a unique name for author and email fieldnames which get checked at post time.
    wp-comments-post.php (version 1.3 around line 20)
    change the fieldnames

    // we made unique field names in the form.
    $authorfieldname = md5( date('ymdh') . DB_USER );
    $emailfieldname = md5( date('ymdh') . DB_USER . 'M');
    $author = trim(strip_tags($_POST[$authorfieldname]));
    $email = trim(strip_tags($_POST[$emailfieldname]));

    in wp-comments.php (version 1.3 around line 39)

    <?php
    // ANTI SPAMBOT HACK, VERSION: BRUTE-FORCE 1.0
    // make unique fieldnames. checked in wp-comments-post.php
    // comment within the hour :-)
    $authorfieldname = md5( date('ymdh') . DB_USER );
    $emailfieldname = md5( date('ymdh') . DB_USER . 'M');
    ?>

    in the html form substitue author and email fieldname with”

    <input type="text" name="<?php echo $authorfieldname;?> id="author"
    and further down
    <input type="text" name="<?php echo $emailfieldname;?> id="email"

    This way every blog (by means of md5 hash of DB_USER) has a unique identifier and blatantly posting data to wp-comments-post.php without the correct fieldnames results in nothing ??
    I hate this spam-o-matic-bots hitting an, even un-announced, blog. I made this hack because i didn’t think this even can be done with a plugin. This can be made more robust with session cookie (not preferred) or with a javascript-generated-hidden-tag-on-post. When possible i would like to see this in 1.3stable
    Success WP team…
    Tr909

Viewing 4 replies - 1 through 4 (of 4 total)
  • i don’t want this in 1.3.

    A solution to the “pre-spamming” was previously announced by the lead developer. Hacks like this, while they can work, unnecessarily add to the task of maintaining a site. For things not merged into the core, plugins are the best best for convenience and simplicity.

    Thread Starter tr909

    (@tr909)

    coveniance and simplicity for the end user? i don’t know but i guess this rotating form-field-name isn’t easily implemented with a plugin. Also i think that some plugins more or less add to execution time while their functionality is very basic to the wp system.

    you must have a crappy server.
    allusion created a plugin that does something similar in that it adds an encrypted formkey to the comment form.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Spam problems? (solution1)’ is closed to new replies.