From eee5a31401a641bb83c52d745e30ea9274e07400 Mon Sep 17 00:00:00 2001
From: "http://joeyh.name/" <joey@web>
Date: Fri, 17 May 2013 13:55:47 -0400
Subject: [PATCH 1/3] Added a comment

---
 ..._fd26fb7f1569e8c44ba8262794f938db._comment | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 doc/forum/How_can_I_prevent_spam__63__/comment_1_fd26fb7f1569e8c44ba8262794f938db._comment

diff --git a/doc/forum/How_can_I_prevent_spam__63__/comment_1_fd26fb7f1569e8c44ba8262794f938db._comment b/doc/forum/How_can_I_prevent_spam__63__/comment_1_fd26fb7f1569e8c44ba8262794f938db._comment
new file mode 100644
index 000000000..a7293288c
--- /dev/null
+++ b/doc/forum/How_can_I_prevent_spam__63__/comment_1_fd26fb7f1569e8c44ba8262794f938db._comment
@@ -0,0 +1,19 @@
+[[!comment format=mdwn
+ username="http://joeyh.name/"
+ nickname="joey"
+ subject="comment 1"
+ date="2013-05-17T17:55:46Z"
+ content="""
+Normally ikiwiki requires a valid session cookie of a logged in user to edit pages. It sounds like you may have the opendiscussion or anonok plugins enabled, which allows anyone to edit without logging in. Recommend disabling them.
+
+Since you know the spammer's IP, put it into ikiwiki.setup:
+
+<pre>
+banned_users:
+  - ip(85.25.146.11)
+</pre>
+
+If the user was logging in, you could also put their username in the ban list.
+
+You can also try enabling the blogspam plugin.
+"""]]

From 56dd31b96307e3290caf374c9fc52c724e35a419 Mon Sep 17 00:00:00 2001
From: "http://claimid.com/richard-lyons" <richard-lyons@web>
Date: Fri, 17 May 2013 16:56:24 -0400
Subject: [PATCH 2/3] Added a comment

---
 ...t_2_d098124f005976ee815d25c883bc9106._comment | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 doc/forum/How_can_I_prevent_spam__63__/comment_2_d098124f005976ee815d25c883bc9106._comment

diff --git a/doc/forum/How_can_I_prevent_spam__63__/comment_2_d098124f005976ee815d25c883bc9106._comment b/doc/forum/How_can_I_prevent_spam__63__/comment_2_d098124f005976ee815d25c883bc9106._comment
new file mode 100644
index 000000000..53e743361
--- /dev/null
+++ b/doc/forum/How_can_I_prevent_spam__63__/comment_2_d098124f005976ee815d25c883bc9106._comment
@@ -0,0 +1,16 @@
+[[!comment format=mdwn
+ username="http://claimid.com/richard-lyons"
+ nickname="richard-lyons"
+ subject="comment 2"
+ date="2013-05-17T20:56:23Z"
+ content="""
+I did indeed have opendiscussion active.  I shall wait to see what happens after disabling it.
+
+The bots seem to make 5 consecutive edits at short intervals (around 2 minutes) using an IP 
+address as a username.  I do not know if the IP is the one from which they work.  There are 
+usually two or three sets of five edits using different IP addresses as username in each hour.
+
+I did try blocking specific IPs but they constantly change.
+
+It would be good if blocking could match a regexp, but as far as I can see this is not an option,
+"""]]

From c4c9c3683b449107b04b1cd0b07064d2f38985db Mon Sep 17 00:00:00 2001
From: "http://claimid.com/richard-lyons" <richard-lyons@web>
Date: Sat, 18 May 2013 04:13:20 -0400
Subject: [PATCH 3/3] Added a comment: SOLVED -- How can I prevent spam?

---
 .../comment_3_deb434d01aaefa18d2791e48d6c824ae._comment   | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 doc/forum/How_can_I_prevent_spam__63__/comment_3_deb434d01aaefa18d2791e48d6c824ae._comment

diff --git a/doc/forum/How_can_I_prevent_spam__63__/comment_3_deb434d01aaefa18d2791e48d6c824ae._comment b/doc/forum/How_can_I_prevent_spam__63__/comment_3_deb434d01aaefa18d2791e48d6c824ae._comment
new file mode 100644
index 000000000..64783befc
--- /dev/null
+++ b/doc/forum/How_can_I_prevent_spam__63__/comment_3_deb434d01aaefa18d2791e48d6c824ae._comment
@@ -0,0 +1,8 @@
+[[!comment format=mdwn
+ username="http://claimid.com/richard-lyons"
+ nickname="richard-lyons"
+ subject="SOLVED -- How can I prevent spam?"
+ date="2013-05-18T08:13:19Z"
+ content="""
+I can now confirm that this particular attack has stopped after removing the opendiscussion plugin.
+"""]]