Extension:ConfirmEdit

From MediaWiki.org

Manual on MediaWiki Extensions
List of MediaWiki Extensions

ConfirmEdit Release status: stable
Implementation	Page action
Description	adds captchas when saving an edit.
Author(s)	Brion VIBBER
MediaWiki	1.6+
Download	Wikimedia SVN

The ConfirmEdit extension enables a very simple text Captcha that will probably catch most bots. It was designed after MediaWiki 1.5, largely by Brion Vibber. The FancyCaptcha addon extension creates more complex image captchas.

Captchas are a way of combating automated edits, helping to ensure that wiki edits are being made by real humans rather than bots. This can be particularly useful for reducing the problem of wiki spam, but captchas reduce accessibility and cause inconvenience to human users. In addition, it will not completely spam-proof your wiki (nor will it protect it from human spammers). You may wish to use this in conjunction with other anti-spam features. Remember to clean up any spam which might slip through the net (keep an eye on your 'recent changes' page). Captcha's can also be used to foil automated login attempts that try to guess passwords.

The reCAPTCHA Plugin is based on ConfirmEdit, and works very similarly. The reCAPTCHA plugin provides an audio CAPTCHA, does not require any python libraries, and has a stronger visual CAPTCHA than ConfirmEdit.

[edit] Installation

[edit] ConfirmEdit

The ConfirmEdit extension requires MediaWiki 1.6.0+. (Current version not working with Debian MediaWiki 1.7.1 as of 10-13-07) The current version(s) require PHP5; for PHP4-compatible versions, use an older version available in the SVN, revision 21970.

• Download the three files from Wikimedia SVN

ConfirmEdit.php

ConfirmEdit.i18n.php

ConfirmEdit_body.php

or Download directly, or use a subversion checkout command such as

svn co http://svn.wikimedia.org/svnroot/mediawiki/trunk/extensions/ConfirmEdit/

• Create a folder in the extensions folder named ConfirmEdit
• Upload the files to the extensions/ConfirmEdit/ folder
• Edit LocalSettings.php in the root of your MediaWiki installation, and add the following line near the bottom:

require_once( "$IP/extensions/ConfirmEdit/ConfirmEdit.php" );

That's all.

Note that ConfirmEdit is quite sensitive to version mismatch (see Discussion).

• If you wish, open ConfirmEdit.php and customize:
  • $wgCaptchaTriggers,
  • $ceAllowConfirmedEmail, (Allow users who have confirmed their e-mail addresses to post URL links without being harassed by the captcha) and
  • $wgCaptchaWhitelist. (Specific IP addresses are not harrassed by the captcha)
    (Alternatively, these settings can be customized in LocalSettings.php.)

[edit] FancyCaptcha addon

The FancyCaptcha addon extension requires MediaWiki 1.6.0+ and the ConfirmEdit extension. The Python Imaging Library must be installed to create the captcha images, but isn't needed after that.

1. Download the files from Wikimedia SVN (latest FancyCaptcha.php, FancyCaptcha.i18n.php, FancyCaptcha.class.php and captcha.py).
2. Upload the files to the extensions/ConfirmEdit/ from the root of your MediaWiki installation.
3. If you wish, open ConfirmEdit.php and customize $wgCaptchaTriggers, $ceAllowConfirmedEmail, and $wgCaptchaWhitelist.
4. Change the $wgCaptchaClass line in ConfirmEdit.php to:

   $wgCaptchaClass = 'FancyCaptcha';

5. Add the following lines to LocalSettings.php in the root of your MediaWiki installation:

   require_once( "$IP/extensions/ConfirmEdit/ConfirmEdit.php" );
require_once( "$IP/extensions/ConfirmEdit/FancyCaptcha.php" );

6. Open FancyCaptcha.php and set the variable $wgCaptchaDirectory to the directory where you will store Captcha images. Below it set $wgCaptchaSecret to your passphrase.
7. Create the images by running the following, where:
   • font is a path to some font, for instance AriBlk.TTF.
   • wordlist is a path to some word list, for instance /usr/share/dict/words. (Note: on Debian/Ubuntu, the 'wbritish' and 'wamerican' packages provide such lists. On Fedora, use the 'words' package).
   • key is the the exact passphrase you set $wgCaptchaSecret to. Use quotes if necessary.
   • output is the path to where the images should be stored (defined in $wgCaptchaDirectory).
   • count is how many images to generate.

   python /path/to/captcha.py --font=<font> --wordlist=<wordlist> --key=<key> --output=<output> --count=<count>

   • An example, assuming you're in the extensions/ConfirmEdit directory (font location from Ubuntu 6.06, probably different on other operating systems):

   python captcha.py --font=/usr/share/fonts/truetype/freefont/FreeSans.ttf --wordlist=/usr/share/dict/words --key=FOO --output=../../../captcha --count=100

   • If you are not satisfied with the results of the words you've generated you can simply remove the images and create a new set. Comic_Sans_MS_Bold.ttf seems to generate relatively legible words, and you could also edit the last line of captcha.py to increase the font size from the default of 40.

Note that FancyCaptcha is quite sensitive to version mismatch. In order to successfully install FancyCaptcha on the legacy versions of MediaWiki, try to use FancyCaptcha revisions, that are known to work for your MediaWiki version:

[edit] VisualMathCaptcha

Extension VisualMathCaptcha can be used, as FancyCaptcha, to do so :

1. Open ConfirmEdit.php, in ConfirmEdit extension directory, and change $wgCaptchaClass value to VisualMathConfirmCaptcha.
2. Add following line in LocalSettings.php, VisualCaptcha inclusion lines :

$wgAutoloadClasses['VisualMathConfirmCaptcha'] = "$IP/extensions/VisualMathCaptcha/VisualMathConfirmCaptcha.class.php";

[edit] Configuration

ConfirmEdit introduces a ['skipcaptcha'] for wgGroupPermissions. This is useful for groups that shouldn't see captchas ever. (Bots and Sysops)

Defaults from ConfirmEdit.php:

$wgGroupPermissions['*'            ]['skipcaptcha'] = false;
$wgGroupPermissions['user'         ]['skipcaptcha'] = false;
$wgGroupPermissions['autoconfirmed']['skipcaptcha'] = false;
$wgGroupPermissions['bot'          ]['skipcaptcha'] = true; // registered bots
$wgGroupPermissions['sysop'        ]['skipcaptcha'] = true;

There are five triggers that can generate a captcha and allow for different situations.

• $wgCaptchaTriggers['edit'] = true; -- Would check on every edit
• $wgCaptchaTriggers['create'] = true; -- Check on page creation.
• $wgCaptchaTriggers['addurl'] = true; -- Check on edits that add URLs
• $wgCaptchaTriggers['createaccount'] = true; -- Check on account creation.
• $wgCaptchaTriggers['badlogin'] = true; -- Check after a failed log-in attempt.

Default triggers from ConfirmEdit.php:

$wgCaptchaTriggers['edit']          = false; 
$wgCaptchaTriggers['create']        = false; 
$wgCaptchaTriggers['addurl']        = true; 
$wgCaptchaTriggers['createaccount'] = true;
$wgCaptchaTriggers['badlogin']      = true;

It is now possible to define a whitelist of known good sites for which the captcha should not kick in.

Sysops users can do this simply be editing the system message page called [[MediaWiki:captcha-addurl-whitelist]]. The expected format is a set of regex's one per line. Comments can be added with # prefix. Example in use on OpenStreetMap

Server administrators might prefer to create a regex more directly/secretly with the $wgCaptchaWhitelist config variable

Some other new config vars:

• $wgCaptchaWhitelistIP - List of IP ranges to allow to skip the captcha
• $ceAllowConfirmedEmail - Allow users who have confirmed their e-mail addresses to post URL links

These are are described more thoroughly in the code comments