Extension:ConfirmEdit

The ConfirmEdit extension enables a simple text Captcha that will probably not allow most bots to edit your site. It was designed largely by Brion Vibber. The FancyCaptcha and reCAPTCHA addons create more complex image captchas.

Captchas are a way of combating automated edits, helping to ensure that wiki edits are being made by real humans rather than bots. This can be particularly useful for reducing the problem of wiki spam, but captchas reduce accessibility and cause inconvenience to human users. In addition, it will not completely spam-proof your wiki (nor will it protect it from human spammers). You may wish to use this in conjunction with other anti-spam features. Remember to clean up any spam which might slip through the net (keep an eye on your 'recent changes' page). Captcha's can also be used to foil automated login attempts that try to guess passwords.

The reCAPTCHA Plugin is based on ConfirmEdit, and works very similarly. The reCAPTCHA plugin provides an audio CAPTCHA, does not require any python libraries, and has a stronger visual CAPTCHA than ConfirmEdit.

Installation
The ConfirmEdit extension requires MediaWiki 1.11.0 or higher and PHP5 (but SVN revisions before 21970 are PHP4-compatible).


 * Download the latest version and download it to your computer
 * Create a folder in the extensions folder named ConfirmEdit
 * Upload the files to the extensions/ConfirmEdit/ folder
 * Edit LocalSettings.php in the root of your MediaWiki installation, and add the following line near the bottom:

Note ConfirmEdit will not work if installed with the wrong mediawiki version (called version mismatch, see Discussion).

Customization in LocalSettings.php
If you wish, customize the following settings in LocalSettings.php (after the require_once line):


 * $wgCaptchaTriggers,
 * $ceAllowConfirmedEmail, (Allow users who have confirmed their e-mail addresses to post URL links without being harassed by the captcha) and
 * $wgCaptchaWhitelist. (Specific IP addresses are not harrassed by the captcha)

Configuration
ConfirmEdit introduces a ['skipcaptcha'] to wgGroupPermissions. This is useful for groups that shouldn't see captchas ever.

Defaults from ConfirmEdit.php:

By default, because the $wgGroupPermissions is "true" for registered bots and sysops, bots and sysops are not affected by the next five captcha triggers, "edit, create, addurl, createaccount, badlogin".

There are five triggers that can generate a captcha and allow for different situations.


 * $wgCaptchaTriggers['edit'] = true; -- Would check on every edit
 * $wgCaptchaTriggers['create']	= true; -- Check on page creation.
 * $wgCaptchaTriggers['addurl'] = true;  -- Check on edits that add URLs
 * $wgCaptchaTriggers['createaccount'] = true; -- Check on account creation.
 * $wgCaptchaTriggers['badlogin'] = true; -- Check after a failed log-in attempt.

Default triggers from ConfirmEdit.php:

The triggers,   and   can be configured per namespace using the   setting. If there is no  for the current namespace, the normal   apply. So suppose that in addition to the above  defaults we configure the following:

Then the captcha will not trigger when adding urls to a talk page, but you will need to solve a captcha any time you edit the project namespace, even if you aren't adding a link.

Requiring only unregistered users to enter a captcha for every edit can be accomplished by:


 * $wgGroupPermissions['user'        ]['skipcaptcha'] = true;
 * $wgCaptchaTriggers['edit']         = true;

Captcha's
There are different captcha engines included with ConfirmEdit.

Calculation
This is the default Captcha. This provides a simple addition or subtraction question for the user.

Set the following to enable this Captcha:

MathCaptcha
This generates an image using TeX to ask a basic math question.

Set the following to enable this Captcha:

QuestyCaptcha
This presents a question and the user supplies the answer. You provide the questions in the configuration.

Set the following to enable this Captcha:

It will randomly choose a question from those supplied. The minimum is one.

Addons
These are Extension addons that depend on having ConfirmEdit installed.

FancyCaptcha addon
The FancyCaptcha addon extension requires MediaWiki 1.11.0 or higher and the ConfirmEdit extension. The Python Imaging Library must be installed to create the captcha images, but isn't needed after that.


 * 1) Download the files from the link given above (they're part of the ConfirmEdit extension).  Make sure to download the same version of the extension as your MediaWiki version.
 * 2) Upload the files to the extensions/ConfirmEdit/ from the root of your MediaWiki installation.
 * 3) Add the following lines to LocalSettings.php in the root of your MediaWiki installation:
 * 4) If you wish, change $wgCaptchaTriggers, $ceAllowConfirmedEmail</tt>, and $wgCaptchaWhitelist</tt> in LocalSettings.php, as described above (they work the same for FancyCaptcha and SimpleCaptcha).
 * 5) Still in LocalSettings.php, set the variable $wgCaptchaDirectory</tt> to the directory where you will store Captcha images.  Below it set $wgCaptchaSecret</tt> to your passphrase.
 * 6) Create the images by running the following, where:
 * 7) * font is a path to some font, for instance AriBlk.TTF.
 * 8) * wordlist is a path to some word list, for instance /usr/share/dict/words. (Note: on Debian/Ubuntu, the 'wbritish' and 'wamerican' packages provide such lists. On Fedora, use the 'words' package).
 * 9) * key is the the exact passphrase you set $wgCaptchaSecret</tt> to. Use quotes if necessary.
 * 10) * output is the path to where the images should be stored (defined in $wgCaptchaDirectory</tt>).
 * 11) * count is how many images to generate.
 * 12) * An example, assuming you're in the extensions/ConfirmEdit directory (font location from Ubuntu 6.06, probably different on other operating systems):
 * 13) * If you are not satisfied with the results of the words you've generated you can simply remove the images and create a new set. Comic_Sans_MS_Bold.ttf seems to generate relatively legible words, and you could also edit the last line of captcha.py to increase the font size from the default of 40.
 * 1) * An example, assuming you're in the extensions/ConfirmEdit directory (font location from Ubuntu 6.06, probably different on other operating systems):
 * 2) * If you are not satisfied with the results of the words you've generated you can simply remove the images and create a new set. Comic_Sans_MS_Bold.ttf seems to generate relatively legible words, and you could also edit the last line of captcha.py to increase the font size from the default of 40.
 * 1) * If you are not satisfied with the results of the words you've generated you can simply remove the images and create a new set. Comic_Sans_MS_Bold.ttf seems to generate relatively legible words, and you could also edit the last line of captcha.py to increase the font size from the default of 40.

How to avoid common problems running Python
C:\python\python.exe C:\Ex\CAPTCHA.py --font C:\Ex\FONT.ttf --wordlist C:\Ex\LIST.txt --key=YOURPASSWORD --output C:\Ex\ --count=20
 * 1) The captcha.py version 29357 is not supported on newer versions of Python, this is due to deprecated md5 although you can use 2.4x.
 * 2) Install the proper version of Python Imaging Library (PIL) 1.5 for Python 2.4.
 * 3) Make the installation of Python on a short folder name. Like C:\Python\
 * 4) Create folder like C:\Ex and place files CAPTCHA.py / FONT.ttf / LIST.txt into the folder.
 * 5) To execute easily run the following example as a batch file:

VisualMathCaptcha
Extension VisualMathCaptcha can be used, as FancyCaptcha, to do so :
 * 1) Open ConfirmEdit.php</tt>, in ConfirmEdit extension directory, and change $wgCaptchaClass</tt> value to VisualMathConfirmCaptcha</tt>.
 * 2) Add following line in LocalSettings.php, VisualCaptcha inclusion lines :

Captcha url whitelist
It is now possible to define a whitelist of known good sites for which the captcha should not kick in.

Sysops users can do this simply be editing the system message page called MediaWiki:captcha-addurl-whitelist. The expected format is a set of regex's one per line. Comments can be added with # prefix. Example in use on OpenStreetMap

Server administrators might prefer to create a regex more directly/secretly with the $wgCaptchaWhitelist config variable

Some other new config vars: These are are described more thoroughly in the code comments
 * $wgCaptchaWhitelistIP - List of IP ranges to allow to skip the captcha
 * $ceAllowConfirmedEmail - Allow users who have confirmed their e-mail addresses to post URL links

Test Plan
See ConfirmEdit Test Plan