Re: [GDB Wiki] Add editor privilege control

[Jonas Maebe <jonas dot maebe at elis dot ugent dot be>]

On 09 Apr 2014, at 14:53, Joel Brobecker wrote:

> Frank - Do you know what would need to be done at the technical
> level to protect ourselves? I would think we first create a  
> EditorGroup
> page in the wiki, then add the corresponding group and its privileges
> in the wiki's configuration, right? Or can everything be done directly
> from the wiki? Anything else we should be doing?

A very useful protection against spammers for our wiki that I've found  
is using the stopforumspam.com blacklist. It's specifically geared at  
stopping wiki/forum spammers and works much better than more generic  
blacklists such as the Spamhaus XBL. Here's how to use it in MediaWiki/ 
PHP:

if(isset($_SERVER['remote_addr']) && ereg('yes', file_get_contents('http://www.stopforumspam.com/api?ip=' 
 . $_SERVER['remote_addr'])))
{
  <it's a blacklisted IP>
}

I know neither PHP nor Python very well (I got the above code from  
somewhere else), so I can't translate it, but I'm sure you get the  
gist. As long as you
a) forbid editing by anonymous users
b) perform the above check at account creation time and whenever  
someone tries to add a link to an article

you should be pretty safe. I've had only 3 potentially bogus account  
registrations and not a single instance of spam on our wiki since I  
started using that blacklist 10 days ago. You can use it freely,  
except if you have more than 20000 queries per day (we have about 200  
account creation attempts per hour on average, sometimes spiking to  
over a 1000). In that case you should download snapshots of their  
database and use that instead, as explained at http://www.stopforumspam.com/downloads/


Jonas