I'm finding that the URL behind the Subject field of trackbacks is not getting passed through the spam filter. In other words, if the trackback is from spammerurl.com but the subject text or trackback body does not contain that URL, the spam filter does not catch the trackback as spam.
For example, bardak.com.ru, which is flagged in our URL filter on this site, is hitting one of our sites with trackback spam. The URL is behind the Subject, but the subject title simply repeats the node's title. Like this: Something funny happened at the store today. No spamming words or phrases are anywhere in the trackback -- just the URL, which does not seem to get caught by the spam filter.
I'm not sure if this isn't a spam module issue, so I will cross-post this with the spam issues section. If this bug does not pertain to this module, please close this report and accept my apologies.
Comments
Comment #1
ankur commentedThanks for catching this, Laura.
A fix has been committed to HEAD, DRUPAL-4-6.
The change only means that you should replace the 4.6 trackback you are currently running with the latest 4.6 trackback (which you can get in the tarball starting 24 horus after this message or by going directly to the repository:
http://cvs.drupal.org/viewcvs/drupal/contributions/modules/trackback/tra...
For a diff to the previous revision of trackback.module, please see
http://cvs.drupal.org/viewcvs/drupal/contributions/modules/trackback/tra...
DETAILS
----------
In short, the spam module API only asks for two things when evaluating for spam: a subject and a body. This works well for comments and nodes, but for trackbacks, the source of the trackback is not stored in either field. The fix was to just contatenate the subject and source URL of the received trackback and submit the concatenation of the two to the spam module's spam_check() function.
-Ankur
Comment #2
laura s commentedYou are awesome! Thanks for the super-fast response! I have two clients who will be delighted.
Comment #3
(not verified) commented