Bug: Email addresses obfuscation does not work in all cases

Email addresses obfuscation does not work in all cases.

Test case

There are cases where it does not work (TWiki version 30 Oct 2004 Rev: 1794, Plugin API version 1.025) :

• double quotes : "truc@bidule.com"
• simple quotes : 'truc@bidule.com'
• href with no quotes : truc@bidule.com
• href with double quotes : truc@bidule.com
• href with single quotes : truc@bidule.com

Environment

-- BenVoui - 26 Feb 2005

Impact and Available Solutions

Follow up

Fix record

Discussion

Old discussion (until no-spam-padding was implemented)

We had an incident report of TWikiSpam in the Support web. Apparently a SpamBot grabbed an address of a registered user from the TWiki.org web site.

TWiki is targeting the corporate Intranet world, however there are many publicly accessible TWiki sites, inlcuding TWiki.org. We need to protect our community from spam bots. A site with recommondations is at http://www.turnstep.com/Spambot/

Fortunately TWiki generates HTML pages dynamically, so it should be fairly easy to obfuscate e-mail addresses. One simple solution to fool the spambots is to use a gif file for the "@" sign. The question is what to present as the mailto link, may be an "__at__" sequence instead of the "@" sign? That should be obvious enough for users to recognize the correct address.

This obfuscation should be made optional, so that it can be disabled for Intranet use.

-- PeterThoeny - 06 Aug 2001

Implemented a simple solution where you specify a "no spam" padding string in TWiki.cfg that gets appended to the domain name. Updated the TWikiAlphaRelease and this TWiki installation here - so bye bye spambots!

Test cases:

• Peter@Thoeny (not valid address for autolink)
• Peter@ThoenyPLEASENOSPAM.com
• Peter@subdomainPLEASENOSPAM.Thoeny.com

-- PeterThoeny - 06 Aug 2001

Peter,

Thanks, glad you took care of this! Could you post a clue or two as to where / what the changes are (maybe which sub) -- I'd like to make the changes in the TWikis I'm using -- a snapshot of twiki.org a few months ago and the 20010315 beta. No hurry, the site is still not up.

Oops, never mind -- I see the diff in an email -- I'll save that somewhere.

-- RandyKramer - 07 Aug 2001

SlashCode now supports auto-spamblocking, see http://slashdot.org/ for details about Slashcode 2.2 - they rotate the spam blocking algorithm every day, which may be a good idea although it's obviously more work.

-- RichardDonkin - 20 Aug 2001

Discussion on the cases where the no-spam-padding does not work

Changed to BugReport re Ben's most recent comment.

-- RichardDonkin - 07 Dec 2004