Spam Detection When Saving a Page
Explanation
Spam Checking is not a scheduled scan but a veto on the save itself: the application listens to the events XWiki fires just before a page is created or updated, and cancels the save when the page looks like spam, so that spam never reaches the wiki at all.
What it inspects is not the content field but the whole document serialised to XML. The title, the page name, the xobjects and the class definition are matched too, which is what catches spam hidden in a comment object or in a page name rather than in the visible text.
A save is refused in two cases: the serialised document matches one of the patterns of AntiSpam.Keywords, or the IP address of the request is listed on AntiSpam.IPAddresses, which is how an account that has already been caught is stopped from contributing again. The second case has one deliberate exception: the guest user is refused on a keyword match but never on its address alone, because XWiki saves some documents as guest at startup and banning that address would break the wiki.
Two kinds of page are never inspected: pages in the AntiSpam space, and pages in the spaces listed on AntiSpam.Excludes. Clearing the "Is Spam Checking Active?" setting stops the inspection entirely.
When a page is refused, four things are recorded and the save is cancelled:
- the account is disabled, so that it cannot log in again;
- its reference is appended to AntiSpam.DisabledUsers;
- the IP address of the request is appended to AntiSpam.IPAddresses;
- the matched keywords, the author and the page are appended to AntiSpam.Logs.
None of the first three happen to a protected user: the save is still refused, but the account survives untouched.
What the author sees is XWiki's own error page, with the reason under "Detailed information" rather than in a message written for the occasion:
The reason itself depends on who is reading it. A protected user is told what matched, so that a false positive can be diagnosed:
The update of [xwiki:Sandbox.SpamCheckDemo] by user [xwiki:XWiki.Admin] has been cancelled since it contains spam. Found spam: [[cheap viagra = [...<content>Get cheap viagra online today...]]]Anyone else gets a message that names nothing, so that a spammer cannot use it to work out which words to avoid:
The update of [xwiki:Sandbox.SpamCheckDemo] has been cancelled since it contains spam.The address that gets banned is read from the X-Forwarded-For header when the request carries one, and from the request itself otherwise. Which entry of that header holds the real client depends on how many proxies sit in front of the wiki, which cannot be guessed, so it is a setting rather than a default: see AntiSpam Configuration.
FAQ
Does the extension check pages that are already on the wiki?
No, only saves. Use Delete Spam Pages and Users for spam that is already there.
Can a disabled account be brought back?
Yes: re-activate the user in the administration, and also remove it from AntiSpam.DisabledUsers and its address from AntiSpam.IPAddresses, or its next save is refused again.
Why was a legitimate page refused?
A pattern was too broad. Patterns match anywhere in the serialised document, so a short one can hit a page name or an xobject value.
What happens if the check itself fails?
The save goes through and the failure is logged, so a broken checker never blocks contributions.
