I just released a minor update of WP Mollom with some bugfixes. This is the changelog:
mollom_manage_wp_queue() function which adds Mollom support to the default comment administration panelMore info and download on WordPress Extend
It took me the better part of June to prepare a new version of Mollom. But today I released version 0.5.0. You can download the package here.
So, a lot has changed since version 0.4.0…
mollom_moderate_comment($comment_id) tag for use in templates and themes. This allows direct moderation of a comment without first having to go to the dashboard.So download, go forth and protect your blog against those vile spammers through Mollom!
These two weren’t the best friends over the past couple of weeks. Since someone notified me they weren’t compatible, it took some time to figure out what was going wrong. My initial suspects was an icky way of dealing with the action hooks. Either by my plugin or WP OpenID. But after extensive testing, I concluded that the order in which the action hooks call the different plugin functions, wasn’t problem.
I identified the problem as the comment data getting lost somewhere along the way. I tested the OpenID plugin and the transition to the Mollom plugin. In the end, I could narrow the problem down to odd behaviour of global variables in WordPress. Let’s take a look at this bit of code:
function dosomething($ds_comment) {
global $ds_comment;
print_r($ds_comment);
return $ds_comment;
}
add_action('preprocess_comment', 'dosomething');
For brevity’s sake, I ommitted the obligatory WordPress plugin header. But if you add it, put this bit in a seperate file, upload it to your plugins/ folder and activate. Now you can test if yourself. The idea is that the array containing the commentdata is shown in your browser just before putting it in the database (notice that your browser doesn’t redirect to the original page, but that’s not the issue here). In reality, you’ll get a blanco page. Meaning the array $ds_comment is in fact empty. Further on, you’ll just pass empty variables and in the end save an empty record to your database. The comment got lost into cyberoblivion. Not very nice.
Now. Just comment out or remove the global $ds_comment; bit and try again. Now, if you submit a new comment, the data will be output to the browser nicely.
Conclusion: If you make the very same variable that was passed as an argument through the function, global, the data just gets lost. Very odd. Now, if you create a new, empty, global variable within the function and assign the data from $ds_comment to it, there is no problem whatsoever.
I wonder how this could happen…
Ow. Making a lot of variables global, especially those with sensitive data, is not really best practice. There are more gracious ways of passing data around like OO programming design or paying attention to correct function reuse. In a future incarnation, I’ll try to reduce the amount of globals I use. For now, I just want the damn thing to behave like it should. ;-)
Well, nothing more to say for now: it’s out. You can download and play with it. It’s a first beta version so beasts can roar it’s head if you have a heavily customized wordpress installation with loads of plugins. Please, drop me a line with all your feedback, code, concerns, requests!
A big thank you to Dries, Benjamin, the testers and all those people that supported me!
So. I scheduled a first public beta release of my Mollom plugin somewhere tonight (CET/UTC+1). The plugin runs quite stable on my own weblog and spam is happily being blocked. I didn’t receive major complaints from testers or users on my own blog in the past week. Yesterday, I cleared the code with Dries who took a glance at the major functionality.
Of course, it wouldn’t be a first beta release if there aren’t still some irks lurking around in the code. This morning, Leo Arias mailed me that the plugin won’t work together with the WP OpenId plugin. Having toyed with my own OpenID implementation for WordPress, I’m not a great proponent of this technology. The way you have to design a plugin implies using several shortcuts. I’m not going to push my release back now, though. I will try to fix this issue in the next release.
My code will also be thoroughly reviewed by the Mollom people.
Thanks to all the testers and those who just listed to become a tester!
Dries made me a nice diagram on the process flow of Mollom. It shows the order in which your Mollom programmable should excute the different API calls.
Note: You should never try to save data to the database before all the Mollom checks including the CAPTCHA have been cleared. The idea is that through the challenge-response flow, the contributor has to validated him/herself as a human instead of forcing the administrator to make an educated guess.
As for the plugin itself: I noticed several small booboo’s myself over the weekend and sorted them out. A public release should be very soon-ish.
Because numbers and graphics can express so much more then words: a visualisation of how Mollom is protecting my blog against spam. I’ve been testing my plugin on and off for the past 2 weeks on my own blog.
The new beta release is almost ready by the way. Just need to pack and ship it to the testers tonight. So here’s what’s new:
WP_Error class in combination with wp_die(). Maybe I’ll do a small item on that one.As things get finalized, I’m thinking about doing a very first public beta release sometime next week. I had very few feedback from testers so far in fact. If people are still interested in joining me for a last spin: drop me a line!
So I did put up a small project page. Not much to see for now. But it’s a start…
Well, I adjusted some of the plugin code over the weekend. The comments’ data (name, e-mail, url, content) isn’t stored in the database anymore but embedded in the CAPTCHA form as a collection of hidden fields. As I don’t want to store the data clientside (cookies and the likes) this seems to be the best way out. The comment is saved only if the CAPTCHA test was succesfully completed.
A particular issue I face are special characters like backslashes, quotes,… things you might encounter in URL’s and such. Luckily, WordPress is quite flexible as it takes this into account during the process of saving a comment in the database. The issue I have to focus on is not breaking the HTML CAPTCHA form itself. This will probably need some extensive testing.
The new version is already protecting this blog against comment spam. If everything goes well, the moderation queue should stay empty of unprocessable spam. In fact, it changes the usage of the queue entirely: instead of an indispensable tool, it becomes an optional means to teach Mollom if a message contains spam, profanity,… You don’t need to use it, but it allows you to correct Mollom in those few cases that may slip through.
Next up: implement functionality against trackback spam. I hope to get that part finished near the end of next week so I can put out a new betaversion of the plugin.
Today, I had an e-mail discussion with Dries and Benjamin over the use of a moderation queue within the context Mollom provides. I have on implemented in my plugin. The idea is that ‘unsure’ comments that don’t get through the CAPTCHA test, land in a moderation queue… sort of.
Mollom was actually designed to get rid of the queue. Checking if a commenter is human or a spambot happens through the CAPTCHA test. Early on in the process of posting a comment. That makes a queue where an administrator has to do the check after the facts quite unnecessary.
The problem is that the way I designed the plugin forced me use a moderation queue altogether. ‘Unsure’ labelled comments happen to land in the database, before the CAPTCHA check. Two months ago, that seemed the logical way out to me. Dries gave me some more insight in the workings of the Drupal module and was able to convince me to seperate the CAPTCHA check from the moderation queue. (I am not nearly into Drupal as I am into the workings of WordPress!)
So. It’s a bit back to the drawingboard for me as this means some parts of the plugin need to be reviewed.
Okay. It’s been almost two weeks since I released the first installment of my Mollom plugin to the testers. I got some feedback and started hacking away. I’m almost ready to release a new betaversion. So, here’s a list of what’s been improved:
As you can guess, I’ve not implemented trackback support yet. Dries and Benjamin suggested to send ‘unsure’ trackbacks to the moderation queue and skip the whole CAPTCHA part. I’m going to implement and release that one in the last testversion.
On a sidenote: I didn’t take into account that the plugin should work with WordPress MU but one of the testers tried it anyway. Apparently, next to a few minor bugs, the plugin seemed to function. Which is a nice bonus.
I still need testers, though. The more the better. So if people are interested to take part: please mail me!
Hum. The plugin in WordPress doesn’t support trackback checking yet. No big deal? Well, I have 24 spams in my moderation queue, the majority of them are trackback spam.
So… yet another feature to implement. Just wondering how the flow of operations should look like. Moreover: how/where do I implement a CAPTCHA? Is it necessary to do this implement? Given the 99.8% accuracy Mollom claims, is it a bad thing if a trackback would be identified as a false positive and the CAPTCHA step is skipped altogether? One can retrieve the false positive through the moderation queue altogheter, no?
Anyway, adding trackback support should be fairly simple.
Yesterday, I made a last codingscram and implemented the entire feedback/moderationqueue in the dashboard. It works acceptable enough to put out a very rough betaversion out to the testers. Which I did yesterday-evening. I’m very curious about their feedback. I’ve already listed some points that will need improvement.
If you’d like to participate in testing please mail me!! Remember Eric Raymond’s famous aphorism: give enough eyeballs, all bugs are shallow!
On the train to Antwerp. I got this idea: If a comment goes into the moderation queue, WordPress automatically sends out an e-mail to warn the site administrator. It would be such a breeze if the user could moderate and send feedback to Mollom through links in that e-mail instead of opening a browerwindow, go to the dashboard and start moderating.
Apparently, Field Commander Wieers got the same idea. Another optional feature I would like to add is the addition of a rel='nofollow' on every link that’s being posted in the comments. Something that could be very easily accomplished through the multiple comments hooks WordPress provides.
A little progress update on my Mollom for WordPress plugin. The past ten days some unexpected real life events kept me back from programming. No worry, I hope to do some hacking in the upcoming long weekend.
So, where do I stand? Well, I just need to implement the last necessary feature: the moderation queue and feedback module that catches the last 0.1% of (unsure/spammy) messages that Mollom can’t process itself. Shouldn’t be much more than an afternoon’s work though.
More important: it’s testing time! I’m in need of people who want to put the plugin to the test and who want to send me some feedback. Areas that need testing are: effectiveness of the spamfilter, usability (easy install, easy use), code (did I write it properly? What could/should be optimized?)
You can drop me a line on my mailadres matthias apetail netsensei dot nl if you want to take part, and I’ll send you the plugin. Important note: you need a stand alone installation of WordPress. The plugin doesn’t work with wordpress.com hosted blogs.
Zo. We zijn een half dagje verder. Dit is de tussenstand: 0 spammers door de mazen van het net gegelipt. 7 spams in de moderation queue waarvan er 3 door jullie werden achtergelaten. 1 spam (Houbi) per ongeluk in de moderation queue blijven hangen. Niettegenstaande de mens legit is.
Kijk, voorlopig laat ik alles daar even hangen. Ik moet nog een feedback module in mijn plugin hangen zodat ik de Mollom servers kan terugsturen waarom iets wel of niet spam/profanity/unwanted/… is.
Tenslotte blijkt er inderdaad iets loos te zijn met het tonen van de image CAPTCHA’s. Da’s alvast doorgegeven.
Al bij al een klein succesje denk ik dan zo.
Oké mensen. Tijd voor het moment van de waarheid. De laatste maand heb ik tussendoor, voornamelijk op de trein, geprogrammeerd aan een plugin voor WordPress. Niet zomaar een plugin, maar eentje die het de diensten van Mollom, de startup van Dries Buytaert en Benjamin Schrauwen, ook voor WordPress gebruikers toegankelijk maakt.
Ik huldig eigenlijk het principe eat your own dogfood. En om eens te kijken hoe sterk mijn plugin reeds staat, zet ik die bij wijze van allereerste publieke test in op mijn eigenste blogje. Akismet en Spam Karma heb ik voor de gelegenheid gewoon uitgeschakeld. Vanaf nu worden jullie comments door de spamfilters van Mollom gehaald.
Hoe werkt het? Bij een normale comment zal je niets merken van het werk dat Mollom achter de scherm uitvoert. Stel dat je een spambot bent, dan wordt je bijdrage gewoon geweigerd nog voor er wordpress een query op de database uitvoert. Moest er nu twijfel bestaan over de legitimiteit, dan wordt je comment in moderatie gehouden en krijg je een eenvoudig testje voorgeschoteld om te bevestigen dat je wel degelijk een persoon bent met de allerbeste bedoelingen.
Bij wijze van proef mogen jullie je even in de commentaren van deze post laten gaan. Het gaat om een proef om de basisfunctionaliteit van de plugin te verbeteren. Verder gaat het er mij nu om een aantal secundaire doeleinden op korte termijn te implementeren. Bij problemen of opmerkingen kan je mij altijd op mijn mailadres, matthias apestaartje netsensei puntje nl, contacteren.
‘Do your worst‘ zou ik zeggen!
O ja, ik ben Benjamin en Dries alvast heel erg dankbaar voor de steun en de feedback van de afgelopen weken!
English readers:
Yes, I’ve been working on a plugin that brings Mollom to WordPress. I’ve enabled my plugin on this blog to protect it from spam through Mollom. This is a preliminary test for the basic, barebones functionality of the plugin: filtering out spam. Unless you’re a spambot, you should have no trouble posting comments. Keep an eye out for the CAPTCHA test, though. If you run into problems or you have suggestions, don’t hestitate to contact me: matthias apetail netsensei dot nl. A big thank you to Dries and Benjamin for their support in these past weeks.
Matthias Vandermaesen / Blogger / Code Ninja / Fotograaf / Reiziger / Muziek & Film lover ( meer...)
Laatste reacties