Revision [9875]
This is an old revision of SecurityModules made by JavaWoman on 2005-07-05 23:26:08.
Wikka Security Modules
see also:
This page collects links to security-related functionality under development; this comprises both anti-spam measures and other security features. The goal is to monitor and discuss the development of what might become an improved "security" package to release with future versions of WikkaWiki.Access Control
Current version: 1.1.6.0The first line of defense for access control would be firewall rules; this is outside the scope of Wikka though - and hence of this page.
Files
HtaccessConfigInfo .htaccessAclHandlerInfo handlers/page/acls.php
Current features
- site level:
- stop referrer spam by keyword matching on the referrer URL (.htaccess)
- page level:
- separate Access Control Lists (ACLs) for reading, writing and commenting a page (admin rights exceed these)
Beta Features
- site level:
- deny access by IP address (.htaccess)
To do or under development
- utility to create/update referrer spam keywords in .htaccess (possibly based on referrers to be banned - see AdvancedReferrersHandler)
- functionality to add/update IP addresses to ban referrers in .htaccess (now manual only - see also Users - To do)
- facility to ban access by IP address in Wikka itself (as option when .htaccess cannot be used)
Related user contributions
noneReferrers
Current version: 1.1.6.0Files
ReferrersHandlerInfo handlers/page/referrers.phpReferrersHandlerInfo handlers/page/referrers_sites.php
ReferrersHandlerInfo handlers/page/delete_referrer.php
ReferrersHandlerInfo handlers/page/review_blacklist.php
Current features
- view referrers or referrer domains for page or for site
- blacklist a referrer domain
- review blacklisted domains
- delete domain from blacklist
Beta Features
AdvancedReferrersHandler- AdvancedReferrersHandler handlers/page/referrers.php - new, advanced referres handling with searching and filtering as well as an accessible form and results table (and more secure as well)
- AdvancedReferrersHandler handlers/page/review_blacklist.php - review blacklisted domains, seamlessly integrated with referrers handling, more accessible and secure
- AdvancedReferrersHandler handlers/page/delete_referrer.php - blacklist a referrer domain, more secure and better integrated with referrers handler
- IP logging for the referrer
To do or under development
see also: HandlingReferrers
- show recorded IP address in referrers list and allow filtering and searching on this
- use blacklisted domains as source to build keyword filter list in .htaccess
- use recorded IP address of referrer spammer to build IP filter list in .htaccess (see also Access control - To do)
Related user contributions
- ...
Search Engines
Current version: 1.1.6.0Files
WikkaSystemFiles actions/header.phpCurrent features
- Don't let old pages get indexed: old page versions, referrers listings and the sandbox all get a <meta name="robots" content="noindex, nofollow, noarchive" /> tag to tell Search engine robots to completely ignore the page
Beta Features
noneTo do or under development
- (optionally) add the rel="nofollow" special attribute to external links so (cooperating) search engine bots will not count these as incoming links for the referred-to page
- whitelisting of 'good' domains which will not get this attribute
- facility to maintain such a whitelist (admin-only page or plain text file)
Related user contributions
Email spambots and email spam
Current version: noneFiles
... to be determinedCurrent features
noneBeta Features
noneTo do or under development
- the BadBehavior plugin can stop known spambots or detect them by observed behavior
- where an email address or email link must be displayed, make sure the email address is obfuscated (as strongly as possible)
Related user contributions
- apply random tokens to the FeedbackAction form (in FeedbackAction actions/feedback.php) so a user must at least be "present" on the site (and have accepted a cookie to establish a session) in order to be able to send feedback (IanAndolina)
Content
Current version: noneFiles
PageName file.phpCurrent features
noneBeta Features
- URLThrottling (to be documented) limits the number of (new) URLs that can be added to a page or included in a page comment; if there are more (new) links than the set limit the user gets a friendly warning but the edit is not accepted.
To do or under development
- make the limits for URLThrottling configurable via the configuration file (currently hard-coded)
- (maybe) make the applied limits a random value within a range so a spammer cannot easily find the actual limit by trial and error
Related user contributions
- DeleteSpamAction (MovieLady) (needs some refinement)
- ""<a href="WikkaSpamFighting#hn_Spam_Block_for_Saving_pages">Spam Block for Saving pages</a> (IanAndolina) (should be extended with a facility to maintain the blacklist)
Users
Current version: noneFiles
PageName file.phpCurrent features
noneBeta Features
- RegisterUserIpAddress (to be documented): IP logging at user registration in UserSettings actions/usersettings.php using extra column in users table.
Although it's rare, it does happen that people sign up for an account just to be able to put spam on ACL-protected pages. Although banning the user access by username would be preferable to banning by IP address, it remains possible the same person signs up for a new account. By logging IP address at registration, IP banning is a last-resort option in such a case (if the same IP address is used to register after banning and this user spams again).
To do or under development
- extra column "status" in users table ('active|disabled|banned')
- functionality to ban user by name
- functionality to add/update IP addresses to ban users in .htaccess (now manual only - see also Referrers to do above)
Related user contributions
noneCategoryDevelopmentSecurity CategoryDevelopmentAntiSpam
CategoryDevelopmentArchitecture CategoryDevelopmentActions CategoryDevelopmentHandlers
