Anti-Spam Options - vbStopForumSpam

vbStopForumSpam

Mod of the month winner October 2009.... That cant be bad :up:

Apologies in advance, this is a copy of the 3.6/3.7/3.8 mod that has been verified to work in 4.0 (its so that I dont get a billion PMs asking if it works in 4.0)

This provides access to a RBL type system for forum admins, listing known spam IP / email / usernames. The RBL database is provided by www.stopforumspam.com. You do NOT need an API key from the website in order to access the database. only to submit data if you should wish to do so.

At the point of user registration, the mod checks if the IP number / provided username / email addresses appear on a block list and can block the registration.

Whilst this isnt the most perfect way to stop all forum spam, its another step that spammers have to overcome.

What it does

It checks with a remote database of known forum spammers. Their IP number, email address and forum username are tested and based on your configuration, you can reject / log / accept user registrations based on what you get back.

This version doesnt have
- whitelisting or the ability to submit users to the database but it will within the next week.
- automatic user deletion / post / PM purging. There are good tools out there already, this does something else.

Instructions are included in the installation.txt file - PLEASE read it first and dont forget to actually upload the files in the upload folder, otherwise it WILL kill your registration progress and you wont see the log file options in admincp.

Changes to vB
- 3 new database tables
- 2 database table alternations
- No new templates.
- 2 Hook (register_addmember_process & register_addmember_complete)

Ive tested it but had feedback that it works with versions as old as 3.6.2... Support should go back to older versions, as long as they have hook support for register_addmember_process / register_addmember_complete

For code to submit spammers to the database, check this post for code changes
https://vborg.vbsupport.ru/showpost....&postcount=288

Reported to work
- 3.6.1, 3.6.2, 3.6.9, 3.6.10, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.74, 3.80, 3.81, 3.82, 3.83, 3.8.4, 4.0beta3, 4.0 Gold, 4.2pl1,2

Installers should remember to refresh their ACP navigation window when they first install it so they can see the new log file menu item.

REQUIRES MySQL 4.1.1+

There is a small mod, coded by Wired1 that will allow you to submit spammer details to the database from the admin control panel, here https://vborg.vbsupport.ru/showpost....&postcount=289 This relies 100% on javascript being enabled and makes no tests that it is enabled.

You need to have an API key from www.stopforumspam.com in order to submit data, its free and easy to get... You DONT need an API key in order to use this mod however, only to submit spammer data.

Issues are
- The usergroup permissions / view details etc DONT work. I jumped the gun and put the permissions controls in there before I put the code in. Please delete the includes/xml/bitfield_vbstopforumspam.xml file and rebuild your postbit

Installation
- Follow the instructions in the zip file, that includes the file upload the correct folders.

Please click Installed

The original thread is at https://vborg.vbsupport.ru/showthread.php?t=176481 where there is a wealth of knowledge about the mod, please ask questions in there.

[TheSupportForum]

i currently have a script i developed which i can integrate this into its
Re-usable Code so it fits nicely with my newest mod which automatically blocks site access and registration attempts, i have already implemented projecthoneypot with it

[ShannonA]

The folks at SFS report that one of the problems I'm hitting is that vBSFS tries to get info on blank email addresses:

2840 /api?email=

Could this be addressed in a future update?

[TheSupportForum]

Originally Posted by ShannonA

The folks at SFS report that one of the problems I'm hitting is that vBSFS tries to get info on blank email addresses:

Could this be addressed in a future update?

that's due to the wrong variable, it might not be registered in the php file correctly
but if i integrate this script into mine i will fix issues like this

justing looking at it, its not even used properly

it should be api?email=$email

[ShannonA]

Based on the logs, the emails and user names getting reported seem really flaky. Lots of repeats and those blank emails. This is how they're accessed in the code:

$username = $vbulletin->userinfo['username'];
$email = $vbulletin->GPC['email'];

Have they changed by vb4.2?

Edit: That's called in register_addmember_process

[TheSupportForum]

Originally Posted by ShannonA

Based on the logs, the emails and user names getting reported seem really flaky. Lots of repeats and those blank emails. This is how they're accessed in the code:

Have they changed by vb4.2?

Edit: That's called in register_addmember_process

you need to call the php variable for email which is $email

where is says

Remote URL to the www.StopSpamLinks.com website for testing an email address

you replace :
http://www.stopforumspam.com/api?email=
with
http://www.stopforumspam.com/api?email=$email

[ShannonA]

Originally Posted by simonhind

you replace :
http://www.stopforumspam.com/api?email=
with
http://www.stopforumspam.com/api?email=$email

Maybe I'm misunderstanding you, but the code certainly seems to add the email address all on its own:

$spambot = getSFSXML($vbulletin->options['vbstopforumspam_url_check_' . $field] . urlencode($data));

In this example, $field would be email and $data would be $email.

The problem is that sfsProcess() seems to be getting really weird results from the two variables I noted:

$username = $vbulletin->userinfo['username'];
$email = $vbulletin->GPC['email'];

Including blanks for $email, or at least that's what it's logging.

[ShannonA]

It looks to me like all those variables are set right and being passed right, but the problem is that vbStopForumSpam sends out those requests even before the spammer has been let in to register. Thus, if they haven't set an email and would be rejected, it checks their email anyway. If they fail at the human question, it checks anyway, sometimes again and again ...

[TheSupportForum]

Originally Posted by ShannonA

Maybe I'm misunderstanding you, but the code certainly seems to add the email address all on its own:



In this example, $field would be email and $data would be $email.

The problem is that sfsProcess() seems to be getting really weird results from the two variables I noted:

Including blanks for $email, or at least that's what it's logging.

change

PHP Code:


        global $vbulletin, $userdata;

        $ip = $vbulletin->session->vars['host'];
        $username = $vbulletin->userinfo['username'];
        $email = $vbulletin->GPC['email'];
        if (($email == '') && (isset($userdata))) { // hook for new FB Connect procedures
            $username = $userdata->fetch_field('username');
            $email = $userdata->fetch_field('email');
        }

        $message = '  GPC_user: '.$vbulletin->GPC['username'].'         GPC_email: '.$vbulletin->GPC['email'];
        $message .= ' Data_user: '.$userdata->fetch_field('username').' Data_email:'.$userdata->fetch_field('email');
        $message .= ' Info_user: '.$vbulletin->userinfo['username'].'   Info_email: '.$vbulletin->userinfo['email'];
        $message .= ' REQ_username: '.$_REQUEST['username'].'           REQ_email: '.$_REQUEST['email'];

        if (($username != '') && ($username != 'Unregistered')) { //disable check if not set
            $result = VBSFSSpam($username, 'username');
            if ($result !== VBSFS_NO_TEST) {
                VBGHSFS_Action('username', $username, $username, $email, $ip, $result);
            }
        }

        if ($email != '') { //disable check if not set
            $result = VBSFSSpam($email, 'email');
            if ($result !== VBGHSFS_NO_TEST) {
                VBGHSFS_Action ('email', $email, $username, $email, $ip, $result);
            }
        }

        $result = VBSFSSpam($ip, 'ip');
        if ($result !== VBSFS_NO_TEST) {
            VBGHSFS_Action('ip', $ip, $username, $email, $ip, $result);
        } 


[TheSupportForum]

Originally Posted by ShannonA

Maybe I'm misunderstanding you, but the code certainly seems to add the email address all on its own:



In this example, $field would be email and $data would be $email.

The problem is that sfsProcess() seems to be getting really weird results from the two variables I noted:

Including blanks for $email, or at least that's what it's logging.

change

PHP Code:

    global $vbulletin;
            
    $ip = $vbulletin->session->vars['host'];
    $username = $vbulletin->userinfo['username'];
    $email = $vbulletin->GPC['email'];

    // todo handle the null error results.
    $result = checkSFSSpam($username, 'username');
    if ($result !== VBSFS_NO_TEST) {        
        sfsActions('username', $username, $username, $email,$ip, $result); 
    }
    
    $result = checkSFSSpam($ip, 'ip');    
    if ($result !== VBSFS_NO_TEST) {
            sfsActions('ip', $ip, $username, $email, $ip, $result);
    }
    
    $result = checkSFSSpam($email, 'email');
    if ($result !== VBSFS_NO_TEST) {
            sfsActions ('email', $email, $username, $email, $ip, $result);
    } 


to

PHP Code:


        global $vbulletin, $userdata;

        $ip = $vbulletin->session->vars['host'];
        $username = $vbulletin->userinfo['username'];
        $email = $vbulletin->GPC['email'];
        if (($email == '') && (isset($userdata))) { // hook for new FB Connect procedures
            $username = $userdata->fetch_field('username');
            $email = $userdata->fetch_field('email');
        }

        $message = '  GPC_user: '.$vbulletin->GPC['username'].'         GPC_email: '.$vbulletin->GPC['email'];
        $message .= ' Data_user: '.$userdata->fetch_field('username').' Data_email:'.$userdata->fetch_field('email');
        $message .= ' Info_user: '.$vbulletin->userinfo['username'].'   Info_email: '.$vbulletin->userinfo['email'];
        $message .= ' REQ_username: '.$_REQUEST['username'].'           REQ_email: '.$_REQUEST['email'];

        if (($username != '') && ($username != 'Unregistered')) { //disable check if not set
            $result = VBSFSSpam($username, 'username');
            if ($result !== VBSFS_NO_TEST) {
                sfsActions ('username', $username, $username, $email, $ip, $result);
            }
        }

        if ($email != '') { //disable check if not set
            $result = VBSFSSpam($email, 'email');
            if ($result !== VBGHSFS_NO_TEST) {
                sfsActions ('email', $email, $username, $email, $ip, $result);
            }
        }

        $result = VBSFSSpam($ip, 'ip');
        if ($result !== VBSFS_NO_TEST) {
            sfsActions ('ip', $ip, $username, $email, $ip, $result);
        } 


[ShannonA]

Thanks. Running an updated version now ...