LnBlog

BotBlock with Invisible CAPTCHA

pageer@skepticats.com (Peter Geer)

It looks like LinkSleeve has been failing me lately. The past week I've been inundated with comment spam. So, to fix that problem, I updated the BotBlock plugin. You can download version 0.2.0 here. Just unzip and drop it in your LnBlog/plugins directory, overwriting the old version.

For the new version, I basically rewrote the plugin. The old version did nothing but force bots to download the comment form before submitting, which was fairly useless.

The new version, however, implements an invisible CAPTCHA. This is not the annoying image-based CAPTCHA you see all over, but rather a simple math problem. Furthermore, it's "invisible" to anyone with JavaScript enabled - i.e. it includes JavaScript code to automatically solve the CAPTCHA and hide the form field. So, for 90% of visitors, the comment form should work as before, but block any bots that don't interpret JavaScript (which is a lot of them). For the rest, there will be a simple math problem and they will be prompted to type in the answer. (Note: There is an option to turn the non-JavaScript text off, if you're so inclined. Of course, that makes it less accessible, but apparently lots of people are into discriminating against the disabled.)

As a fall-back measure, I also included an option (on by default) for some simple content filtering - that is, comments with HTML links in them get blocked. The idea is that most of the comment spam I get includes plain text, HTML, and BBCode links, but LnBlog only allows plain text in comments. Therefore, anyone who posts a comment with an HTML link is either a spammer or too stupid to read the instructions. Either way, we probably don't care what they have to say.

So there it is. I haven't had any comment spam since installing the new version on my site. Of course, I'm still having problems with TrackBack spam for some reason. Apparently the LinkSleeve and TrackbackValidator plugins aren't working for this particular wave, though I don't know why. I'll have to work on that.

New BotBlock plugin

pageer@skepticats.com (Peter Geer)

I've just uploaded a new version of the BotBlock plugin. This one adds two options. One makes the comment check depend on a cookie, so user agents that don't accept them will be blocked. The other option blocks any comment that contains markup for HTML or BBcod-style links. Since markup isn't allowed in comments anyway, it's a pretty good bet that comments with links are spam. Either that, or the commenter wasn't paying attention.

Aren't I Web 2.0-y

pageer@skepticats.com (Peter Geer)

I've been reworking the sidebar calendar plugin lately. It was kind of buggy and just didn't work as well as I would have hoped. In particular, using query strings to browse through the months just really sucked.

My solution to the bugginess was to rewrite a large chunk of it. It's much cleaner and more managable now.

My solution to query strings sucking was to get with this whole Web 2.0 thing and do it with AJAX. So now, rather than the whole page refreshing when you click the previous month link on the calendar, a JavaScript requests an update from the server and then updates the page in place. The down side of this is that the next and previous links don't work if you don't have JavaScript or are using an archaic browser. Of course, you can still use the archive links, so it's not like you can't get to the previous month's links.

I've installed the new calendar plugin on this site. I haven't made it available for download yet because it's still in progress and requires a couple of support files. However, it will be standard in the next version.

TrackBack spam solved

pageer@skepticats.com (Peter Geer)

Following up on the post I just made about the BotBlock plugin, I thought I should mention that the reason I'm getting comment spam is that I turned off the DisableComments plugin on LinLog. The reason I turned it off was to test out the TrackbackValidator plugin that comes standard with LnBlog 0.8.0.

The DisableComments plugin allows you to automatically turn off replies (TrackBacks and comments) on entries older than a given number of days. Since my big problem was TrackBack spam, and it was mostly on entries that were more than a month old, I "fixed" the problem by simply setting DisableComments to disable replies after 30 days. On the up side, this stopped the flood of TrackBack spam. On the down side, it stopped all legitimate replies too.

Well, it turns out that I don't really need the DisableComments plugin as much anymore, Happily, the new TrackbackValidator plugin, which only allows TrackBacks from URLs that actually link to you, has completely solved my comment spam problem. My server access logs will show lots of TrackBack pings, but not a single spam ping has gotten through.

The only down side is that now I need to worry about comment spam on old entries.

BotBlock plugin

pageer@skepticats.com (Peter Geer)

I added a new plugin to the plugins page today. It's called BotBlock, and it's just simple attempt to keep robots from posting comments.

I wrote this because, for the past several days, I've been getting a lot of comment spam. The messages were comming in groups of two to six messages at a time, had varying content, and came from varying IP addresses. However, the general format of all the posts was the same (short fake greeting, followed by lines of URLs and two or three word descriptions) and they all targeted the same blog entry. So obviously these were either being posted by a robot or a very stupid human.

Thus I implemented this stop-gap solution. Basically, it just adds a hidden field to the comment form that contains a hash value based on your LnBlog configuration and the client IP address. When the client submits a comment, it checks this hash. If it's either missing or doesn't match the calculated value, the comment is rejected.

Of course, this depends on the bot being relatively stupid and the spammer not being motivated enough to figure out your specific configuration. A determined spammer could bypass this protection without too much effort, which is why I call this a stop-gap. However for small-time blogs like mine, which aren't worth the effort to crack, this solves the immediate problem.

TrackbackValidator: sneak preview

pageer@skepticats.com (Peter Geer)

I read an interesting article on TrackBack spam today, called Taking TrackBack Back (from Spam). The ideas seemed sensible to me, so I banged out a TrackbackValidator plugin to implement it.

The idea behind the paper and the plugin is simple: the sites linked to by TrackBack spam never contain a link back to your blog entry, but nearly every legitimate blog entry that pings you does. Therefore, rather than fancy content filter, we can eliminate TrackBack spam by simply fetching the URL in the ping and only accepting it if the page actually contains a link to your site.

This plugin implements that idea. It also includes options to white-list all pings coming from your domain and to allow ping that link to files under your entry (e.g. an uploaded file or the comments page) rather than just the permalink. My spam rates have been way up lately, so I'll be uploading this tonight and we'll see how it goes.

New plugin: HideSidebar

pageer@skepticats.com (Peter Geer)

I've uploaded a new plugin to the plugins page. It's called HideSidebar and it, well, hides the sidebar. The idea came from this comment and the plugin is a sort of proof of concept. I don't know how useful it will be, but it's a good demonstration of the power of the plugin system.

For the curious, it works by injecting an inline JavaScript into the page when it loads. It has PHP code to add a link to the menubar and insert the JavaScript into the page. The JavaScript then manipulates the DOM to hide the sidebar when the link is clicked. It's really quite simple. In fact, the JavaScript portion took me longer to write than the rest of the plugin.

New plugins: RecentComments and PrivateBlog

pageer@skepticats.com (Peter Geer)

I've added a couple of new plugins to the plugins page.

The RecentComments plugin is a sidebar panel that shows a list of the most recently posted plugins. It's got configuration options to control the display of the poster's name and the entry it's posted to.

The new verions of PrivateBlog, which used to be part of the standard set, lets you block access to a blog by all except a given list of logged-in users. You can allow access by username or by group membership. In addition to redirecting pages, the new version also blanks out all entries, articles, and comments that might be displayed by other plugins (like in the sidebar). However, this only works for dynamic PHP pages: static files like RSS feeds are not blocked. So if you really want the blog to be truly private, you might want to consider turning off the RSS plugins.

Also, I fixed some broken and missing links on the plugins page. The two plugins I added yesterday now have links associated with them and the links to the two editor plugins are fixed now.

ContactForm plugin

pageer@skepticats.com (Peter Geer)

Ask and ye shall receive! By popular demand, I cooked up a little contact form plugin today. You can download it from the plugins page. To install, just extract it from the ZIP archive and drop it in your LnBlog/userdata/plugins folder. (Note: This is the new recommended location for non-standard plugins. You can still use LnBlog/plugins or your per-blog plugins folder as well.)

Basically, this plugin provides a contact page that users can use to send e-mail to the blog owner. It also puts a link to the contact page in the sidebar. Note that the blog owner must have an e-mail address set.

This is just the initial release, so I'll expand and integrate this more later. You know, putting the link in user profiles, allowing more than just the blog owner to be e-mailed, etc. I'm trying to go with that whole open-source "releaswe early, release often" thing here. Plus this is only the second plugin I've done that generates and entire page, so I wanted to work on the basic design before worrying too much about features.

Theming, Part 2: Sidebar Templates and Plugins

pageer@skepticats.com (Peter Geer)

It's time for part 2 of the LnBlog themes tutorial series. In this episode, we'll cover modifying your sidebar. This will include a brief discussion of how theme templates work as well as an introduction to the plugin system. In the process, we will also create a very simple and extremely unimpressive plugin. Note that in this tutorial, unlike the last one, I will assume that you have a basic knowledge of HTML and CSS. This tutorial will also include some PHP code, although I will nto assume a working knowledge of PHP (although if you have one, it will help).

As you may recall from last time, LnBlog's theme system has a concept of paths. This applies not only to images and style sheets, as we saw before, but also to template. In other words, LnBlog will look for a given template first in your blog's templates directory, second in the templates directory of your current theme, and lastly in the templates for the default theme. This means that you can easily modify the templates for each of your blogs individually or for all of them at a time.

Modifying the template

Let's start by making a copy of your LnBlog/themes/default/templates/include_sidebar.php file and saving it on your local hard drive so we can play with it. If you open up the file in a text editor, you'll notice that there's almost nothing in it. It should just look like this: activateEventFull($tmp=false, "sidebar", "OnOutput"); $EVENT_REGISTER->activateEventFull($tmp=false, "sidebar", "OutputComplete"); ?> Of course, if you don't know PHP, that's probably doesn't mean anything to you. In fact, it probably doesn't mean much even if you do know PHP. That's because this code is part of LnBlog's event system

As you may already know, the default page banner, menubar, and sidebar in LnBlog are all implemented as plugins. If you open up your include_banner.php or include_menubar.php, they'll contain similar code. Basically, this code raises an event, i.e. it tells LnBlog's event manager that something interesting is happening and any plugin that's interested in this event better get it's act together. The event manager them checks a list of plugins that signed up to be notified when this event happens and tells them to do their thing.

Now, since this is a template, we can actually ad HTML code right into it. For illustrative purposes, I'll add some of my favorite links to the sidebar. Here's what the resulting code looks like: <?php global $EVENT_REGISTER; $EVENT_REGISTER->activateEventFull($tmp=false, "sidebar", "OnOutput"); ?> <h3>Recommended Links</h3> <ul> <li><a href="http://blogs.msdn.com/oldnewthing/">The Old New Thing</a></li> <li><a href="http://www.securityfocus.com/">Security Focus</a></li> <li><a href="http://www.larkware.com/">The Daily Grind</a></li> </ul> <?php $EVENT_REGISTER->activateEventFull($tmp=false, "sidebar", "OutputComplete"); ?> Notice that I broke the PHP code into two blocks and put the HTML in between them. Since tempaltes are actually PHP files, anything inside the <?php ?> tags is treated as PHP code, and anything outside them is treated as HTML. If you're sharp, you probably noticed that I did this because of the event code: I put my markup between the OnOutput and OutputComplete events.

If you save this file and upload it to your blog's templates directory, you'll see your list of links in the sidebar. However, you'll notice that the links are at the bottom of the sidebar. That's because all the plugins are loaded by the OnOutput event. If you move the HTML code above that event, then all your links will end up at the top of the sidebar. But what if you want your links in the middle somewhere? Maybe you want your links between your articles and your RSS feeds. Well, that's why this isn't the recommended way to add to the sidebar.

A simple sidebar plugin

However, there is good news. Writing a simple plugin to display some links in the sidebar is easy. Really easy. In fact, it's about a dozen lines of boiler-plate PHP code with your HTML inserted in the middle. And once you have the plugin written, it will be detected by the plugin manager and you will be able to change where it appears in the sidebar by changing its load order in the plugin loading configuration page.

Here's a plugin version of the links in the example above: <?php class MyLinks extends Plugin { function MyLinks() { $this->plugin_desc = "Shows my favorite links in the sidebar"; $this->plugin_version = "0.1.0"; } function show_links() { ?> <h3>Recommended Links</h3> <ul> <li><a href="http://blogs.msdn.com/oldnewthing/">The Old New Thing</a></li> <li><a href="http://www.securityfocus.com/">Security Focus</a></li> <li><a href="http://www.larkware.com/">The Daily Grind</a></li> </ul> <?php } } $plug = new MyLinks(); $plug->registerEventHandler("sidebar", "OnOutput", "show_links"); ?> This is about the simplest plugin you can have. It is a simple PHP class with a constructor that defines the version number and a short description, and a single method that dumps some HTML output to the screen. Note at the bottom that you have to create an instance of the class and register the method with the event manager.

Now is probably a good time to mention that plugins use a path mechanism too. In other words, you can have plugins that apply only to a single blog, just like you can with theme template and style sheet. Just make a "plugins" directory in the blog's directory and put the plugins there. They will be treated just like a regular plugin, but no other blog will be able to see them.

So, now let's install your new plugin. Copy the above code and paste it into a new file named sidebar_mylinks.php. Note that it is very important that you not have any blank lines or spaces outside the PHP <?php >> tags, as this will cause error messages due to the way PHP handles output. Now, create that plugins directory in you blog's directory on the server and upload the sidebar_mylinks.php file into it. If you open up your blog in a web browser, you should see the new links. If you change the load order of your sidebar_mylinks plugin from the plugin loading page, then the link section will move in the sidebar.

If you want to have several independant sidebar sections, you can make copies of this plugin to achieve that. Just change the HTML code, the plugin_desc on the fourth line, and change all three instances of the name MyLinks to MyOtherLinks, or something like that (the exact name doesn't matter, so long as no two plugins have the same name). If you're feeling adventurous, you can also adapt this to add markup to the banner or menubar by changing the "sidebar" parameter in the registerEventHandler line to "banner" or "menubar".

You can download files for this tutorial here. In the next installment, we'll go into theming the content areas of a page, including templates for blog entries. We"ll also cover modifying the associated style sheets and possibly adding some images.