Automatically delete users flagged by system?

Development
3

I got it to work.

Creating a user with Insomnia, filling its profile with an Akismet trigger, which triggers a Review.
A few checks are done and the user is automatically deleted.

The Review properties for the script to trigger a user deletion are:

  • Type: ReviewableAkismetUser, ReviewableUser or ReviewableQueuedPost
  • Score > 0

I don’t want to automatically delete users flagged by other users than @system.

Here’s the PHP script I use:

<?php

// Immediately verify the authenticity of the request.
if (array_key_exists('HTTP_X_DISCOURSE_EVENT_SIGNATURE', $_SERVER)) {
    $discourse_payload_raw = file_get_contents('php://input');
    $discourse_payload_sha256 = substr($_SERVER['HTTP_X_DISCOURSE_EVENT_SIGNATURE'], 7);
    
    // For security, configure the webhook with a secret in Discourse and set it below.
    $discourse_payload_secret = '2J3tM5X4WYGkGp0tTkmu';
    
    // Verify that the request was sent from an authorized webhook.
    if (hash_hmac('sha256', $discourse_payload_raw, $discourse_payload_secret) == $discourse_payload_sha256) {
        echo 'received';
    }
    else {
        die('authentication failed');
    }
}
else {
    die('access denied');
}

// Prepare the payload for use in the PHP script.
$discourse_json = json_decode($discourse_payload_raw);

$reviewable = $discourse_json->reviewable;

// Set up the API URL
$api_url = "https://discourse.canapin.com/review/$reviewable->id/perform/delete_user?version=0";
//$api_url = "https://discourse.canapin.com/review/$reviewable->id/perform/delete_user?version=$reviewable->version";


// Verify that the "type" and "score" properties are valid
if (($reviewable->type == "ReviewableUser" || $reviewable->type == "ReviewableAkismetUser" || $reviewable->type == "ReviewableQueuedPost") && $reviewable->score > 0) {
  // Set up the curl options
    $options = array(
        CURLOPT_URL => $api_url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST => "PUT", // Set the request method to PUT
        CURLOPT_HTTPHEADER => array(
            "Api-Key: 6666666666666666666666666666666666666666666",
            "Api-Username: system"
        )
    );
    // Initialize the curl session
    $curl = curl_init();
    curl_setopt_array($curl, $options);
    // Make the API call
    $response = curl_exec($curl);
    curl_close($curl);
    // Decode the response
    $response_data = json_decode($response);
    print_r($response_data);
}   else {
    exit;
}

?>

On a scale from 0 to 10… How ugly reliable it is, regarding the context in which it will work (0 false positives in 2 years for Discourse and akismet detections)?

I have a few questions about the review request payload initiated by Discourse when a user is detected as a potential spam account.

  1. Why are there 2 requests for 1 ReviewableUser with minimal differences between their respective payloads (the first request is on the left)?

    payloads
    payloads1100×602 44.7 KB

  2. What does link_admin mean?

  3. When I delete manually a user (detected by Akismet) from the review panel, it triggers the review webhook with a new payload containing, among other things: "user_deleted": false. Shouldn’t this be true? :thinking:

  4. In the URL https://discourse.canapin.com/review/355/perform/delete_user?version=0", does the “version” here refers to the “version” found in the payload? Should I care about this parameter? Should it be equal to the payload’s version parameter?