(turn on minor changes) http://engineer.openguides.org/?RecentChanges
I've been massively spammed by some Wikispamming bastards. What's a quick way to delete all these nodes?
I also can't see how all these Categories and Locales were auto-created, there doesn't seem to be a main node linking to these categories?!?!?
So, as a basic way of blocking the spammers, how about just rejecting anything with "http://" in the Title of a node?
Philip Greenspun had a nice little social engineering tip about abusive posters to web forums. When they'd locked out a particular IP address or login, instead of getting a "nyerr nyerr you've been banned" message, they'd allow the user to read, but when trying to post they'd get a technical-sounding error like "resource busy" or "database not available". The abuser would just think the site was shit and give up, instead of working out they'd been banned and finding ways around it.
Not sure if this will work with Wiki spammers... I'll be dropping the entire netblock of this wiki spammer at the firewall tonight.
On Mon 18 Jul 2005, Rev Simon Rumble simon@rumble.net wrote:
(turn on minor changes) http://engineer.openguides.org/?RecentChanges
I've been massively spammed by some Wikispamming bastards. What's a quick way to delete all these nodes?
Your recent changes are really really slow. I can't actually see them at all because I get timed out before the page loads. Have you got your indexes set up? (Explanation of that is somewhere in the list archives; I think in a conversation with jimbo.)
If they're the same people who hit the vegan guide to Oxford recently then try nuking everything with '&#' in the name of the node. That got everything bar four or five pages for me.
Ah, it's just managed to load. Nuke everything with 'supercasino' in the node name. In psql this is something like
delete from node where name like '%supercasino%'; delete from content where name like '%supercasino%'; delete from metadata where name like '%supercasino%';
Syntax is probably the same for other databases. Insert the usual warning to back up the database before you do this in case you typo.
Kake
This one time, at band camp, Kake L Pugh wrote:
Your recent changes are really really slow. I can't actually see them at all because I get timed out before the page loads. Have you got your indexes set up? (Explanation of that is somewhere in the list archives; I think in a conversation with jimbo.)
I think that's a combination of it being a pretty small-spec virtual machine and the motherlode of data created by the spammer. I seem to have index files, so I'm presuming I do have indexing. I'm using sqlite.
Ah, it's just managed to load. Nuke everything with 'supercasino' in the node name. In psql this is something like
delete from node where name like '%supercasino%'; delete from content where name like '%supercasino%'; delete from metadata where name like '%supercasino%';
That's done the job (in sqlite). Thanks!
A couple of improvements that this suggests: 1) Limit the number of categories and locales a node can have. 2) Allow regex matches of text in nodes and reject any edits that include them (in this case, ^Http.**) 3) I couldn't even see the root node that had auto-created all the "Http" categories and locales in the Recent Changes. Is there a limit in the number displayed?
Looking through the logs, here's the culprit. Note the referrer it's come in on:
81.213.173.173 - - [17/Jul/2005:22:19:57 +0100] "GET / HTTP/1.1" 200 8290 "http://www.google.com.tr/search?q=edit+this+page+wiki&hl=tr&lr=&..." "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 81.213.173.173 - - [17/Jul/2005:22:20:20 +0100] "GET /newpage.cgi HTTP/1.1" 200 4804 "http://engineer.openguides.org/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 81.213.173.173 - - [17/Jul/2005:22:20:29 +0100] "POST /newpage.cgi HTTP/1.1" 302 325 "http://engineer.openguides.org/newpage.cgi" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 81.213.173.173 - - [17/Jul/2005:22:20:31 +0100] "GET /?action=edit;id=Kaleci HTTP/1.1" 200 6864 "http://engineer.openguides.org/newpage.cgi" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 81.213.173.173 - - [17/Jul/2005:22:26:08 +0100] "POST /?action=edit;id=Kaleci HTTP/1.1" 200 - "http://engineer.openguides.org/?action=edit;id=Kaleci" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 81.213.173.173 - - [17/Jul/2005:22:31:35 +0100] "POST /?action=edit;id=Kaleci HTTP/1.1" 200 - "http://engineer.openguides.org/?action=edit;id=Kaleci" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
On Tue 19 Jul 2005, Rev Simon Rumble simon@rumble.net wrote:
I seem to have index files, so I'm presuming I do have indexing.
Not that kind of index - the database kind.
http://openguides.org/mail/openguides-dev/2004-September/000502.html
Kake
openguides-dev@lists.openguides.org
-
Kake L Pugh -
Rev Simon Rumble