=== Sabre === Contributors: dlo Donate link: Tags: spam, admin, registration Requires at least: 2.2 Tested up to: 2.3.3 Stable tag: 0.6.3 Sabre is an acronym for Simple Anti Bot Registration Engine. It's a set of counter measures against spam registration on your blog. == Description == You gave your readers the possibility to register freely to your blog but you're tired of being infested by automatic registration from spam bots ? Sabre is the solution. This modular protection can run a set of unobstrusive controls and include a captcha or math test in the registration form. You can choose to include both or one test or let the plugin choose randomly the test. Another possibility is to ask the user to confirm his registration by clicking on a link submitted by mail after he registered. This confirmation must take place within a maximum period of time or the account will become unusable. == Installation == 1. download the archive 1. unzip and drop all the files, as is, in your plugins/sabre directory. 1. Enable the plugin in the WP Admin >> Plugins section. 1. Change the parameters in the WP Admin >> Manage >> Sabre tab. 1. Other languages Sabre is delivered in English and French but can be easily used with other languages. You just have to create a file sabre-xx_YY.po (xx_YY being the language code of your WordPress settings. Eg: fr_FR for French) from the existing file sabre.pot using PoEdit. Then, just translate the text strings located after the "msgid" tag and put the translated string after the "msgstr" tag. The resulting sabre-xx_YY.mo file has to be stored in the sabre/languages directory. Alternatively, you can find the translation files (.mo et .po) of some languages in the FAQ page. (Note: if you are upgrading from a previous install, simply overwrite the older files with the new ones in the instructions above) == Frequently Asked Questions == = What are the required components for Sabre ? = In order to run, Sabre needs the following: - PHP 4.3.2 or higher - GD 2.0.2 or higher - and WordPress, of course! = Where can I find a translation of Sabre in my own language ? = Ready-to-use translation files are available in : 1. [Danish](http://mads.eu/wp-plugins#sabre) (thanks to Mads Christian Jensen) 1. [Dutch](http://lentewind.nl/downloads/vertaling-sabre) (thanks to Bart) If you can't find the files for your language, you can create them yourself with the sabre.pot file included in the package and PoEdit. = I just installed Sabre and now the users already registered can’t log in anymore. What’s going wrong ? = You decided to activate the registration confirmation and the users registered before Sabre’s installation received the following message when they try to log in : “ERROR : Invalid registration status”. This is because Sabre considers they have not confirmed their registration. You need to go to Manage >> Sabre >> Approved registrations and manually register each user giving his WordPress account ID and clicking on ”Add” under “Manual registration”. == Screenshots == 1. Registration form with captcha added 2. Registration form with math test added == Documentation == All the functions of Sabre are located in the Manage >> Sabre tab of the administration environment. Sabre interface is divided into four tabs: 1) "General options" First, some numbers related to valid, invalid and pending confirmation registrations are displayed. Then, you can find the parameters of Sabre: 1a) Captcha Options Click on the checkbox "Activate captcha" to display, in the registration form , a characters string that the user will have to copy back. The other captcha's parameters will let you define the string's length, valid characters used to generate the random string as well as the number and type of graphic objects used to "blur" the string. The captcha is based on QuickCaptcha 1.0 from Web 1 Marketing, Inc released under GNU GPL. 1b) Math Options Click on the checkbox "Activate math test" to display, in the registration form , an arithmetic operation. The user will have to give the result. The other parameter let you define the valid operations the plugin will choose from. Recognized operations are addition, substraction and multiplication. The plugin will choose randomly two numbers between 1 and 20 and one of the listed operations. 1c) Sequence of tests Select "All" to add all the active tests in the registration form. Select "Randomly" and the plugin will choose one of the tests, active or not. 1d) Stealth Options Click on the checkbox "Enable stealth test" to activate a set of internal tests that try to detect if the current registration is done by a human being or not. These tests doesn't interact with the user and run undetected for a regular human registration. These tests include the following: - Control that the registration form is loaded before the answer is sent to the server. - Control that the IP adress of the requester is the same when the form is sent back. - Control that the browser used to register has Javascript capabilities as many spambots lack them. You can choose to reject the registration in such case, clicking on the checkbox "Block if Javascript unsupported". - Control that the Javascript capability is not faked. - Control that the registration is done within a maximum period of time. You can set this period (in seconds) under "Session time out". Try to maintain this number as low as possible for security reasons but high enough to let a human fill the registration form. Default value is 5 minutes (300 seconds). - Control that the registration form is possibly filled by a human, in a minimum amount of time. A spambot will spend very little time to fill the form and send it to the server compared with human possibilities. You can set this minimum amount of time (in seconds) under "Speed limit". Default value is 5 seconds. - Control that IP address is not banned by DNSBL servers. You can turn on/off this control, clicking on the checkbox "Check DNS Blacklists". 1e) Confirmation Options Click on the checkbox "Activate confirmation" to force the user to confirm his registration on your blog. The other parameter lets you give a period of time (in days) for the user to confirm his registration before the account becomes unavailable. When this option is activated, the registering user will receive his user id and password by mail as usual. He is also asked to confirm his registration within x days following a link added to the mail. During this period of time, the user account is waiting for the confirmation but usable to connect to the blog. If the confirmation is not done in the due time, the account will become unusable. By clicking on the "Deny early sign-in" checkbox, you can prevent the connection of the new user until confirmation of his registration. If you want to suppress automatically the user account created by WordPress when the registration is cancelled, just click on the "Suppress unregistered users" checkbox. This option will be taken into account either in a manual cancelation or in case of exceeded period of time. Keep in mind that all the posts and links owned by the suppressed user account will be deleted as well. IMPORTANT : The users with "edit_users" capability will not be controled. Then, it is always possible to use the default admin account created by WordPress during the blog installation. 1f) Miscellaneous Options Click on the checkbox "Show banner" to add a reference and a link to Sabre's site at the bottom of the registration form. It's up to you to decide if you want to advertise Sabre or not ! Click on the checkbox "Suppress Sabre" if you want to delete all information created by Sabre (table and options) when deactivating the plugin. CAUTION : Use this option only if you decided to stop using Sabre or if you want to purge the table and reset all the options to their default values. Don't forget to click on "Save options" to store your changes. 2) "Blocked Registrations" Tab List the invalid registrations with the cause of error. The number of new registrations blocked since your last visit is shown between parenthesis on the tab. It's possible to suppress the log giving the number of days to retain (20 days by default) and clicking on "Delete". You can ask Sabre to do it automatically, from now on, with the same period by clicking on the checkbox. 3) "Approuved Registrations" Tab List the registration definitively accepted (status = ok) or pending validation (status = to confirm). The user id created is displayed and gives access to its data by just clicking on it. The number of new accepted registrations since your last visit is shown between parenthesis on the tab. It's also possible to register manually a user giving his WordPress account identification number or all existing WordPress users clicking on the checkbox then pressing the "Add" button. To cancel the registration of users, just click on the corresponding checkbox in the list, then press the "Unregister" button. 4) "About" Tag A wise text about the author and his work. A must-read you can't resist to ! == History == v. 0.6.3 Small adjustments done to comply with WordPress 2.3.3 v. 0.6.2 Added parameter to check if IP address is banned by DNSBL servers. v. 0.6.1 Change the Sabre table definition as some MySql versions doesn't allow text columns to have default value. This was preventing the creation of the table during Sabre initialization in some occasion. v. 0.6.0 Added parameter to delete WordPress account automatically when registration is canceled, either manually or because of exceeded period of time. Added parameter to insert a reference to Sabre at the bottom of the registration form. Added parameter to select the number of days for automatic purge of history log. Added parameter to delete all information about Sabre when deactivating the plugin. This will clean your WordPress blog of tables and options created by Sabre, if you decide to stop using Sabre. Performance improvement bypassing the tests if errors already detected before calling Sabre (eg. user name and/or mail missing) Performance improvement by code optimization Reinforced access security to the administration panels of Sabre using wp_nonce_field v. 0.4.2 Corrected bug in the storage of the number of days for registration's confirmation V. 0.4.1 Added parameter to deny/authorize newly registered users to sign in before registration is confirmed. Added the possibility to automatically register all existing WordPress accounts. Added several messages to give the status of operations done. v. 0.4.0 Added several new internal tests to make Sabre more efficient in spambot detection. Those tests run undetected for regular human registrars. Those new tests are: - Control that the registration form is loaded before the answer is sent to the server. - Control that the IP adress of the requester is the same when the form is sent back. - Control that the browser used to register has Javascript capabilities as many spambots lack them. - Control that the Javascript capability is not faked. - Control that the registration is done within a maximum period of time. - Control that the registration form is possibly filled by a human, in a minimum amount of time. Changed the way to control who can bypass the registration confirmation : Sabre now tests the "edit_users" capability and no longer the user level. This will ensure that all accounts with a high level of rights will always be able to sign in. V. 0.2.2 Code optimized and splitted in various files to reduce server loading. Automatic cleanup enhanced. V. 0.2.1 Added a possibility to include the test randomly in the registration form. Added manual suppression of logs. V. 0.1.1 First public version