Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
It looks like these guy found a way to cirumvent the nofollow by adding <sub>
tags, see code of http://drupal.org/drupalgive#comment-5917670, please. Not tested myself to abuse the signature this way, but his backlink is missing rel="nofollow" for sure.
Comments
Comment #0.0
hass CreditAttribution: hass commenteda
Comment #0.1
hass CreditAttribution: hass commenteda
Comment #1
gregglesThe all have rel=nofollow as far as I can tell. Which link is getting past the system in your opinion?
Comment #2
silverwing CreditAttribution: silverwing commentedMichelle's signature link in
sub
doesn't have nofollow, but user asb's standard links do.I also use
sub
in my signature, but I seem to get nofollowed (i.e. http://drupal.org/node/975052#comment-3723536)Comment #3
hass CreditAttribution: hass commentedYes, I mean Michelles signature...
Comment #4
WorldFallz CreditAttribution: WorldFallz commenteddefinitely weirdly inconsistent-- my sig also uses sub, and is also correctly no-followed. Can't seem to find any other case though... still looking...
Comment #4.0
WorldFallz CreditAttribution: WorldFallz commenteda
Comment #5
lizzjoyI'm closing this issue due to inactivity. If it is still a problem, please open this issue again and leave a comment. Thanks.
Comment #6
hass CreditAttribution: hass commentedInactivity does not mean the bug has been fixed.
Comment #7
dddave CreditAttribution: dddave commentedI think this issue gets more attention in this queue.
Comment #8
drummComments like https://www.drupal.org/drupalgive#comment-5812556 aren't actually using the signature for
It is part of the comment body.
We can either consider nofollow-ing all comment content, or think about policies for enforcing using the comment body & signature "properly".
Comment #9
WorldFallz CreditAttribution: WorldFallz commentedIt's actually related to whether or not someone enters a link with the <a> tag or by typing the url and letting the url to link filter do it.
tag link: Drupal.org (correctly given 'nofollow')
auto link: http://drupal.org (missing 'nofollow').
I believe it's caused by the order of the filters. The 'Convert URLs into links' filter has to come before the 'Limit allowed HTML tags' filter and the 'Add rel="nofollow" to all links' option must be checked.
Comment #10
tvn CreditAttribution: tvn commentedWorldFallz, here is a fresh dev site: http://searchdocs-drupal.redesign.devdrupal.org/. Can you take a look there and confirm that it's indeed filter order?
Comment #11
WorldFallz CreditAttribution: WorldFallz commentedSure! But I just tried to get there and after drupal/drupal I'm getting a white screen....
Comment #12
tvn CreditAttribution: tvn commentedCafuego was working on something there and probably broke it :)
You can test on mine for now http://tvn-drupal.redesign.devdrupal.org/
Thanks!
Comment #13
WorldFallz CreditAttribution: WorldFallz commentedthat one works! can you email me an admin username/pass ? I need at least enough access to get to admin/config/content/formats... thanks.
Comment #14
WorldFallz CreditAttribution: WorldFallz commentedYep... that was it. I fixed by moving the 'Convert URLs into links' filter to be the first filter in the 'filtered html' text format.
You can see it here: https://tvn-drupal.redesign.devdrupal.org/node/2372259
Comment #15
drummComment #16
drummActually.. that's not a good solution quite yet.
I commented on https://tvn-drupal.redesign.devdrupal.org/node/2372259 with
And
[/codefilter_code]
gets added.Comment #17
WorldFallz CreditAttribution: WorldFallz commentedOKey doke... moved code filter to before url converter.
Comment #18
WorldFallz CreditAttribution: WorldFallz commentedAny chance we could push this forward. With all the changes to user participation, it would be great to get this one fixed once and for all. I still see quite a few links missing the 'nofollow'.
Comment #19
drummI think this needs a bit more testing, which I'll require for #2396165: Code filter configuration removes blank lines. Re-ordering filters is just too likely to have side-effects without good QA.
And the specific order change needed added to the issue summary here.
Comment #20
WorldFallz CreditAttribution: WorldFallz commentedAh I hadn't seen that one. So we need to wait for that to be fixed first, and then do some more testing for this one?
Added the other issue as related. And I'll look for that one to be fixed, so I can pick and do some more testing when it's done.
Comment #21
drummIdeally both should be fixed at once, since they are both re-ordering filters. However, if either has good testing and is ready significantly earlier, that one doesn't need to be held back.
Comment #22
drumm#2396165: Code filter configuration removes blank lines is now deployed, which includes adding
nofollow
to URLs converted to links. This should cover signatures too, but I do want to double check new comments, since the old filtering is cached.Comment #23
drummThe cc all from another deployment fixed up the existing signatures. They must have been hitting the
check_markup()
cache.Comment #25
WorldFallz CreditAttribution: WorldFallz commentedYep-- from what I can see, all links (content and sig) are properly no-followed again. Awesome!