Getting tons of comment spam, in spite of captcha

the g2.1.2 captcha was slightly flawed. please upgrade to g2.2 and ensure that captcha is enabled for guest comments.

--------------
Enter the Gallery 2 Theme Contest today!

what's the version of your captcha module?
- you should have captcha version 1.1.4.
- comment module version 1.1.3

and in site admin -> captcha, it should be set to "high" for guest comments.

also note that human people can still post spam. so if your spam volume is less than 5 comments per day or so, it could well be that some people actually post those comments manually. that's not what captcha can protect from.

--------------
Documentation: Support / Troubleshooting | Installation, Upgrade, Configuration and Usage

you should have captcha version 1.1.4. - Yes
comment module version 1.1.3 -Yes

and in site admin -> captcha, it should be set to "high" for guest comments - Yes

About twice a day I have to clear the same spam possibly from one person posting as Guest

I'm in the same boat as Merira. I've been using Gallery 2 for at least 6 months, but it has only been in the last few weeks that spam has become an issue. Maybe captcha isn't enough these days? Maybe addition spam prevention such as the AKISMET service would be helpful, or at least some kind of comment moderation queue so that we don't have links to p0rn and other such undesirables placed on our sites?

Excellent! Just cleared out a dozen or so spam comments again today. It seems there are either some people with WAY too much time on their hands planting these spam comments, or there are some smart bots getting around which OCR the captcha image to get the code. To be honest I think the captcha image displayed by G2 is pretty basic, and probably quite easy to OCR and successfully get the correct code out of. Some options I've seen on forums is that you have to enter the captcha in reverse, but it wouldn't be too long before bots got around that either. Another option to comment security and perhaps even replace captcha might be KittenAuth. There is no way a bot is going to get around that reliably as it requires you to click on every image showing a particular item. I think it is a bit friendlier than captcha too. Akismet is on the way, and I think for now at least this will plug the hole. Was getting very close to disabling comments on my site all together.

mod_security works well for filtering comments with embedded URL addresses. However, exceptions have to be made if you intend to use the Permalinks & Link Items plugins or use the "Remote Web Site" upload method.

Apache 2.2.4 / mod_security 1.9.4

set this globally in httpd.conf

then per <VirtualHost> you want to exclude, add this to it's corresponding <Directory> container:

I read this article with a fresh installed G2, until now I don't suffer from spam comments.
But I still look for a mail to the admin for each comment created, to be the first one reading each comment and be able to delete spam immediately.

I read about akismet and kittyauth, my favorite module for G2 would be KittyAuth, using my own pictures from my gallery, feeded with my keywords (or tags).

(just my 2 cent)

Frank

---
http://photos.franksteidl.ch

We don't get many comments. It would not be a burden to have all comments held until they are approved. Something like 'moderation' on Google Groups.

FYI, I've added Akismet support to the comment module in 2.3 so when you upgrade to the latest code, you can sign up for a key at www.akismet.com and plug it in on the comment Site Admin page and then have it rescan all of your comments and flag all the spam ones. Then it will keep new spam comments out. In the past week, Akismet has blocked 1000+ spam messages in my production gallery (http://menalto.com/gallery) and only let in about 30. Marking the new comments as spam is relatively quick and easy. It's nice not to be overrun by spam anymore

modules/comment/AddComment.inc

You can do this by creating a new error state and modifying the comment page to display this error. In the modules/comment/AddComment.inc you can modify the handle request to include this code:

            if (empty($form['comment'])) {
                $error[] = 'form[error][comment][missing]';
            }

In context, it's part of the handleRequest method:

    /**
     * @see GalleryController::handleRequest
     */
    function handleRequest($form) {
        global $gallery;

        $itemId = GalleryUtilities::getRequestVariables('itemId');

        /* Make sure we have permission to add a comment */
        $ret = GalleryCoreApi::assertHasItemPermission($itemId, 'comment.add');
        if ($ret) {
            return array($ret, null);
        }
        
        list($ret, $isAnonymousUser) = GalleryCoreApi::isAnonymousUser($gallery->getActiveUserId());
        if ($ret) {
            return array($ret, null);
        }
        
        $redirect = $status = $error = array();
        if (isset($form['action']['add'])) {
            GalleryCoreApi::requireOnce(
                'modules/comment/classes/GalleryCommentHelper.class');
            
            if (empty($form['subject'])) {
                $form['subject'] = '';
            }
            
            if (empty($form['author']) || !$isAnonymousUser) {
                $form['author'] = '';
            }
            
            if (empty($form['comment'])) {
                $error[] = 'form[error][comment][missing]';
            }
            

You can then make a change to modules/comment/templates/AddComment.tpl to display the error. Search for the code:

    {if isset($form.error.comment.missing)}
    <div class="giError">
      {g->text text="You must enter a comment!"}
    </div>
    {/if}

And add the new section that will display the error directly after:

    {if isset($form.error.comment.http)}
    <div class="giError">
      Comments do not allow links!
    </div>
    {/if}