BlackListPlugin < TWiki

TWiki Web>BlackListPlugin (2017-01-26, GilbertHsyu) (raw view)
---+!! Black List Plugin

<!--
   Contributions to this plugin are appreciated. Please update the plugin page at
   http://twiki.org/cgi-bin/view/Plugins/BlackListPlugin or provide feedback at
   http://twiki.org/cgi-bin/view/Plugins/BlackListPluginDev.
   If you are a TWiki contributor please update the plugin in the SVN repository.
-->
<sticky>
<div style="float:right; background-color:#EBEEF0; margin:0 0 20px 20px; padding: 0 10px 0 10px;">
%TOC{title="Page contents"}%
</div></sticky>

%SHORTDESCRIPTION%

---++ Description

This is a simple utility to keep black sheep away from a public TWiki site. The site can be protected against excessive page access (e.g. by bad robots), suspicious activities of users, such as multiple registrations or rapid topic updates indicating Wiki:WikiSpam, or saving text with wiki-spam.

The Plugin monitors activities by IP address and uses three IP address lists to protect the TWiki site:
   * WHITELIST: Manually maintained list of users who should never get on the BANLIST
   * BLACKLIST: Manually maintained list of malicious users
   * BANLIST: Automatically updated list of users with suspicious activities
On topic save, text is compared to a known list of spam patterns. If wiki-spam is identified, topic save is cancelled, an error message is shown, and the IP address is put on the BANLIST. Two wiki-spam lists are used:
   * Local SPAMLIST: Manually maintained list of spam patterns
   * Public wiki-spam list: Big list of wiki-spam patterns, retrieved from external web site
Users on the BLACKLIST and BANLIST will get an error message on every page access.

The registration form can also be protected from improper use.

To fight Wiki-spam, the Plugin can also add a =rel="nofollow"= parameter to external URLs. Search engines will not follow links that have this parameter, taking away the incentive to add spam to TWiki.

---++ Plugin Settings

Plugin settings are stored as preferences variables. To reference a plugin setting write ==%<nop>&lt;plugin&gt;_&lt;setting&gt;%==, i.e. ==%<nop>INTERWIKIPLUGIN_SHORTDESCRIPTION%==

---+++ General settings

   * One line description, is shown in the %SYSTEMWEB%.TextFormattingRules topic: 
      * Set SHORTDESCRIPTION = Utility to keep malicious users away from a public TWiki site

   * Debug plugin: (See output in =data/debug.txt=) 
      * Set DEBUG = 0

   * Log access of blacklist and spam list activities: (0 or 1) 
      * Set LOGACCESS = 1

   * Access restriction: 
      * Set ALLOWTOPICCHANGE = %USERSWEB%.TWikiAdminGroup
      * Set ALLOWTOPICRENAME = %USERSWEB%.TWikiAdminGroup

---+++ WHITELIST, BLACKLIST and BANLIST settings

   * WHITELIST: Comma delimited list of IP addresses; possible to use partial addresses ending in a dot 
      * Set WHITELIST = 127.0.0.1, 132.206.126.243, 128.135.70.58, 128.135.70.247, 128.32.117., 200.72.246.90

   * BLACKLIST: Comma delimited list of IP addresses; possible to use partial addresses ending in a dot 
      * Set BLACKLIST = 203.88.152., 203.88.155., 219.65.75.
#BanList <form name="banlist" action="%SCRIPTURL{viewauth}%/%WEB%/%TOPIC%#BanList" method="post">
   * BANLIST: Automatically updated list of IP addresses based on BANLIST configuration 
      * Action: <select name="ban_action"> <option></option> <option value="ban_add">Add</option> <option value="ban_remove">Remove</option> </select> IP address(es) <input type="text" name="ip" size="16" value="" class="twikiInputField" /> <input type="submit" value="Submit" class="twikiSubmit" /> %BLACKLISTPLUGIN{ action="%URLPARAM{ban_action}%" value="%URLPARAM{ip}%" }%
      * Current list: %BLACKLISTPLUGIN{ action="ban_show" }%
</form>

   * BANLIST configuration, comma delimited list of: 
      1 Points for registration
      1 Points for each save and upload
      1 Points for view and other actions
      1 Points for view raw
      1 Threshold to add to BANLIST
      1 Measured over time (in seconds)
      * Set BANLISTCONFIG = 10, 5, 1, 5, 120, 300
      * Your current score: %BLACKLISTPLUGIN{ action="user_score" }% for IP address %REMOTE_ADDR%

   * Message for users on BLACKLIST and BANLIST: 
      * Set BLACKLISTMESSAGE = Your IP address %REMOTE_ADDR% is black listed at the %WIKITOOLNAME% web site due to excessive access or suspicious activities. Please contact site administrator gilbert.hsyu@mail.mcgill.ca if you got on the list by mistake.

---+++ Wiki-spam filtering settings

   * Filter wiki-spam on topic save and HTML file uploads based on SPAMLIST: (0 or 1) 
      * Set FILTERWIKISPAM = 1

   * Comma separated list of Web.Topics to exclude from wiki-spam filtering on topic save: 
      * Set SPAMEXCLUDETOPICS = 
#SpamList <form name="spamlist" action="%SCRIPTURL{viewauth}%/%WEB%/%TOPIC%#SpamList" method="post">
   * Local SPAMLIST: Manually maintained list of spam patterns (NOTE: *Must be* %SYSTEMWEB%.RegularExpression patterns) 
      * Action: <select name="spam_action"> <option></option> <option value="spam_add">Add</option> <option value="spam_remove">Remove</option> </select> wiki-spam regex pattern(s) <code>http://.*?</code><input type="text" name="spam" size="32" value="" class="twikiInputField" /> <input type="submit" value="Submit" class="twikiSubmit" /> %BLACKLISTPLUGIN{ action="%URLPARAM{spam_action}%" value="%URLPARAM{spam}%" }%
      * Current list: %BLACKLISTPLUGIN{ action="spam_show" }%
</form>

#ExcludeList <form name="spamlist" action="%SCRIPTURL{viewauth}%/%WEB%/%TOPIC%#ExcludeList" method="post">
   * EXCLUDELIST: Manually maintained list of exceptions to public wiki-spam patterns, useful to exclude patterns listed incorrectly as spam (NOTE: *Must be* %SYSTEMWEB%.RegularExpression patterns) 
      * Action: <select name="exclude_action"> <option></option> <option value="exclude_add">Add</option> <option value="exclude_remove">Remove</option> </select> exclude spam regex pattern(s) <code>http://.*?</code><input type="text" name="spam" size="32" value="" class="twikiInputField" /> <input type="submit" value="Submit" class="twikiSubmit" /> %BLACKLISTPLUGIN{ action="%URLPARAM{exclude_action}%" value="%URLPARAM{spam}%" }%
      * Current list: %BLACKLISTPLUGIN{ action="exclude_show" }%
</form>

   * Public wiki-spam list: Big list of wiki-spam patterns, retrieved from external web site (thanks to <nop>MoinMoin's [[http://moinmoin.wikiwikiweb.de/AntiSpamGlobalSolution][AntiSpamGlobalSolution]] wiki-spam list) 
      * Set SPAMLISTURL = http://arch.thinkmo.de/cgi-bin/spam-merge

   * Cache refresh time (in minutes) for public wiki-merge pattern list: 
      * Set SPAMLISTREFRESH = 60

   * Cache refresh time (in minutes) for internal wiki-spam regular expression cache: 
      * Set SPAMREGEXREFRESH = 10

   * Message for users trying to save text with wiki-spam: 
      * Set WIKISPAMMESSAGE = Wiki-spam detected: "%WIKISPAMWORD%" is a banned word and cannot be saved. Your IP address %REMOTE_ADDR% is black listed at the %WIKITOOLNAME% web site due to suspicious activities. Please contact site administrator %WIKIWEBMASTER% if you got on the list by mistake.

---+++ Registration protection settings

   * Protect registration: (number of minutes to expire, 15 minutes is recommended, 0 to disable) 
      * Set REGEXPIRE = 0
      * If enabled, a magic number is protecting the registration process. TWiki expects a form field with a magic number. An error message is shown if not valid or if expired. This makes it harder to register a user by a script. A hidden field needs to be added to the registration form:%BR% =&lt;input type="hidden" name="rx" value="%<nop>BLACKLISTPLUGIN{ action="magic" }%" /&gt;=

   * Regular expression list of !WikiWords that are banned from registering: 
      * Set REGWIKINAMEBANLIST = [A-Z]+[a-z]*[0-9]+[A-Z][A-Za-z]*, [A-Z]+[a-z0-9]+[A-Z]+[A-Za-z]*[0-9]+

   * Regular expression list of e-mails that are banned from registering: 
      * Set REGEMAILBANLIST = \@binkmail.com, \@guerrillamail\.(biz|com), \@hidemyass\.com, \@mailinator\.com, \@safetymail.info, \@snkmail.com, \@[\w\.-]*trash[\w\.-]*\.

   * Message shown when registering with outdated magic number or with banned content: (this message is deliberately vague) 
      * Set REGMESSAGE = Registration not possible, please try again.

---+++ Nofollow link setting

   * Add a =rel="nofollow"= parameter to external URLs. Use this is to fight Wiki-spam. Search engines will not follow the link if a URL has a nofollow parameter, such as =&lt;a href="http://spammer.com/" rel="nofollow"&gt;=. Specify topic age in hours for which the nofollow parameter should appear (set it to a value that gives you enough time to remove spam); set it to -1 to add the nofollow parameter unconditionally to external URLs; or 0 to disable: (-1, 0, 1...N) 
      * Set NOFOLLOWAGE = -1

---++ Don't Invite Spammers

   * Spammers search for sites with known spam signatures. Don't use this page as an invitation for spammers by telling search engines NOT to index this page: 
      * Set HTTP_EQUIV_ON_VIEW = <meta name="robots" content="noindex" />

---++ Plugin Installation Instructions

__Note:__ You do not need to install anything on the browser to use this plugin. The following instructions are for the administrator who installs the plugin on the server where TWiki is running.

   * Download the ZIP file from the Plugin web (see below)
   * Unzip ==%TOPIC%.zip== in your twiki installation directory. Content:
| *File:* | *Description:* |
| ==data/TWiki/%TOPIC%.txt== | Plugin topic |
| ==data/TWiki/%TOPIC%.txt,v== | Plugin topic repository |
| ==lib/TWiki/Plugins/%TOPIC%.pm== | Plugin Perl module |
| ==pub/TWiki/%TOPIC%/.htaccess== | Apache access control to protect pub dir |
| ==templates/oopsblacklist.tmpl== | Generic oops message |
   * Make sure =pub/TWiki/%TOPIC%/= is writable by the CGI user (typically =nobody=)
   * Run the configure utility in your browser to enable the Plugin
   * Make sure that non-administrators cannot edit this plugin topic. By default, this topic is write protected with an =ALLOWTOPICCHANGE = !TWikiAdminGroup= setting.
   * Test if the installation was successful: 
      1 Using above form, add the IP address of one of your workstations to the BANLIST
      1 Access TWiki from that workstation 
         * if you look at a TWiki topic (with the view script) you should see the BLACKLISTMESSAGE (defined above) after a one minute timeout
         * else, you should get an 500 Internal Server Error for other scripts
      1 On a different workstation, remove the IP address of the test workstation from the BANLIST

---++ Known Issues and Limitations

   * Scan for script eval() and escape() is currently hard-coded

---++ Plugin Info

|  Plugin Author: | TWiki:Main.PeterThoeny |
|  Copyright: | © 2004-2013 Peter Thoeny, [[http://twiki.org/][TWiki.org]]<br /> © 2008-2013 TWiki:TWiki.TWikiContributor |
|  Plugin Version: | 2013-03-22 |
|  Change History: | <!-- versions below in reverse order --> |
|  2013-03-22: | TWikibug:Item7151: Add new throwaway e-mail addresses |
|  2013-03-08: | TWikibug:Item7151: Add new throwaway e-mail addresses |
|  2013-02-28: | TWikibug:Item7154: Add REGWIKINAMEBANLIST and REGEMAILBANLIST to protect TWiki from bogus registrations; remove 60 min sleep time on ban |
|  2013-02-17: | TWikibug:Item7154: Use noindex meta tag on this plugin page because we do not want to invite spammers who search for known spam signatures |
|  2011-07-10: | TWikibug:Item6725: Change global package variables from "use vars" to "our" |
|  2010-07-10: | TWikibug:Item6519 - fix for empty oops messages in TWiki-4.x; fix for redirect to oops not working in TWiki-5.0 |
|  29 Mar 2007: | Doc fixes; change view=raw penalty from 20 to 5 |
|  18 Mar 2007: | Scan for evil script eval() and escape() in topic text and attachments; support for TWiki 4.2 (using new =TWiki::Func::getExternalResource=) |
|  28 Dec 2006: | Fixed bug where EXCLUDELIST pattern was removing only part of a wiki-spam pattern |
|  27 Dec 2006: | Support for TWiki 4.1 |
|  01 Jul 2006: | Added EXCLUDELIST; scan for evil script eval in attachments; scan also .js and .css attachments; fixed writeLog error on Cairo |
|  02 Jun 2006: | Added wiki-spam filtering for HTML attachments to combat TWiki:Codev.HtmlAttachmentSpam |
|  29 Apr 2006: | Added =%<nop>BLACKLISTPLUGIN{ action="spam_show_n" }%= that shows the local spam list in a shareable format with newline separator |
|  07 Feb 2006: | TWiki Release 4.0 fix to allow registration with e-mail verification, reset password and approve |
|  03 Jan 2006: | Filter lines with space from spam list; fixed bug that inproperly filtered HTML from spam list; Dakar Release fix (end/postRenderingHandler issue) |
|  08 Nov 2005: | Doc fixes; code warning fixes; allow empty local SPAMLIST and public spam list |
|  04 Nov 2005: | Added registration protection with magic number |
|  30 Oct 2005: | Dakar Release compatibility: Work around Dakar preferencs bug |
|  29 Oct 2005: | Added wiki-spam filtering to prevent topic save with wiki-spam |
|  27 Oct 2005: | For BANLIST, add/remove multiple IP addresses at once, contributed by TWiki:Main.MichaelDaum |
|  22 Jan 2005: | Added NOFOLLOWAGE handling |
|  19 Jan 2005: | Added score for "view raw" to address e-mail harvester issue |
|  05 Apr 2004: | Fixed bug in event log (requiring update of earlier Plugin versions); doc updates |
|  04 Apr 2004: | Added WHITELIST and BANLIST |
|  21 Mar 2004: | Initial version |
|  CPAN Dependencies: | none |
|  Other Dependencies: | none |
|  Perl Version: | 5.005 |
|  License: | GPL ([[http://www.gnu.org/copyleft/gpl.html][GNU General Public License]]) |
|  TWiki:Plugins/Benchmark: | %SYSTEMWEB%.GoodStyle 99%, %SYSTEMWEB%.FormattedSearch 99%, %TOPIC% 97% |
|  Plugin Home: | http://TWiki.org/cgi-bin/view/Plugins/%TOPIC% |
|  Feedback: | http://TWiki.org/cgi-bin/view/Plugins/%TOPIC%Dev |
|  Appraisal: | http://TWiki.org/cgi-bin/view/Plugins/%TOPIC%Appraisal |

__Related Topics:__ %SYSTEMWEB%.TWikiPreferences, %SYSTEMWEB%.TWikiPlugins, TWiki:Codev.WikiSpam
Topic revision: r6 - 2017-01-26 - GilbertHsyu
TWiki
Copyright &© 1999-2025 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback
Note: Please contribute updates to this topic on TWiki.org at TWiki:TWiki.BlackListPlugin.