580310 - add captcha to verbatim was: malicious usage report on Verbatim - spam from user folcklord

Status: RESOLVED FIXED

(Webtools Graveyard :: Verbatim, defect)

Description

[Tomer Cohen :tomer]

Attachment: screenshot of unexpectable behavior

I'm seeing some suggested strings from the user folcklord which appears to be spam. I can get rid of this by myself, but that spammer may spam us again. It is also possible that all locales are affected by this usage. 

According to the user information panel, that account have 296 pending strings. I'm unable to see these strings from the page, but probably all of them are spam.
http://localize.mozilla.org/accounts/folcklord/


I've asked how we can prevent on irc://irc.freenode.org/#pootle, and got reply from aala that they added some captha functionality to Pootle. Please make sure to activate these features.

Comment 1

[Tomer Cohen :tomer]

s/aala/alaa. Sorry.

Comment 2

[Zibi Braniecki [:zbraniecki][:gandalf]]

Thanks Tomer!

I started by simply deleting the user, which is of course naive since they can probably create a new one. If this will happen I'll try deactivating without removing (which may confuse the bot).

That's for the short term. I'll be interested in seeing if removing the bot removed his suggestions as well (I doubt, but...)

I'll see tomorrow if the version we use does have captcha and if not I'll upgrade to the one that has.

Thanks for the report!

Comment 3

[Dwayne Bailey]

Hi Gandalf,

Don't think we've backported the captcha to 2.0.  We're testing 2.1 beta1, its definitely in there.  You might need to check with Alaa on #pootle to see if it would be easy to backport.

Comment 4

[Friedel Wolff]

Captcha support was backported and is available in Pootle 2.0.5, albeit unlocalised.  It would be good to upgrade to Pootle 2.0.5 and Toolkit 1.7.0 anyway, so I would recommend this.

Comment 5

[chris hofmann]

sound like this may be fixed. is that correct?

Comment 6

[Friedel Wolff]

It should be enabled since the current installation is upgraded beyond those versions already. It can be verified by pasting a URL into a text field as an anonymous user (the contact form, or a project where anonymous suggestions are allowed).