Spam account under Users and Roles

[dung]

Hello,

• Application Version - e.g., OJS 3.1.2.
• We just found out in one of our journals we have a lot of spam accounts as in attachment
• The path is https://journalhosting.ucalgary.ca/index.php/cpmss/management/access#users
• We do not know exactly how to deal with it. If you can point us, we will be able to carry out.

Thank you so much for any help!

Dung.

[madileweb]

Hi @dung:

You cannot remove users, instead you can merge with another user. You can register a “recycle bin” user and merge all users you want to remove to that “recycle bin” user. This is for all PKP platforms.

Regards,
Diego

[dung]

Hello Diego,

Thank you very much for your reply, we can and will do that. But how can we stop this to happen again -can you tell me where did they do this, on registration page? if so can I put in a recaptcha?

Best regards,

Dung.

[madileweb]

@dung, there is two security ways to implement, first method is confirm email before use new acount and, for sure, second method is implement a recaptcha. Both options, can be activated from config.inc.php. For recaptcha you must have a google account.
Using recaptcha prevents automatic registers, and verifyng account mails you sure that email of user is correct.

Regards,
Diego

[dung]

Thank you Diego for directing us, we will do.

[ctgraham]

We encountered some very persistent spammers who were completing the ReCAPTCHA challenge and validating the email link. We developed two additional plugins to combat this:

Removing spam registrants

The mergeUsers tool would be most helpful, I think, in the case of a large number of users. In the other post, James describes using a PHP script to call the mergeUsers tool on a list of hundreds or thousands of usernames. ReCAPTCHA and email validation are setup in config.inc.php. In my personal experience, we found that spammers had completed both ReCAPTCHA and email validation, so our best response was using the plugins:

[dung]

Hi ctgraham, I will try out these 2 plugins. Thanks for that!
Dung.

[dung]

Hello @ctgraham,

To let you know when we install honeypot we found a minor bug and fixed it. The error occurs when clicked on config Settings after successfully installed - the settings page will not load instead an error message. Then we looked at php_error log below

The error was:

PHP Warning: filemtime(): stat failed for plugins/generic/formHoneypot/templatestemplates//settingsForm.tpl in /var/www/html/ojs-3.1.2-4/lib/pkp/classes/template/PKPTemplateResource.inc.php on line 51

So we made that changes below and that fixed the issue.

in file ojs/plugins/generic/formHoneypot/FormHoneypotPlugin.inc.php

changes:

//return parent::getTemplatePath($inCore) . ‘templates’ . DIRECTORY_SEPARATOR;
return parent::getTemplatePath($inCore) . DIRECTORY_SEPARATOR;

As you can see it is a simple fix. config settings of the plugin will load and works as expected after this fix.

Dung.

[ctgraham]

@dung

To let you know when we install honeypot we found a minor bug and fixed it.

Further discussion is here:

Resulted in Error page after clicking on config settings of the plugin