Staged user creating a full account and posting a link receives numerous spam flags

Bug
1

Filing this as a bug for now, but it may be a feature.

A user emails a group message and communicates back and forth for many messages over an extended period of time. 2 months after starting the group message the user registers on the site and unstages, becoming a TL0 user. This user then posts a topic which includes a link used previously in the group message. The user is promptly silenced by the system, and numerous flags are raised by the system due to the newuser spam host threshold. A user should not be ā€œpenalizedā€ by the system for posting a perfectly normal topic due to the existence of a group message while they were a staged user.

4 Likes
3

Yes we have had this bug for a long time.

Probably we need to better consider the dates the user ā€œjoinedā€ based on staging.

3 Likes
4

We were just hit by this again, 58 PMs to the moderator group created. Weā€™ve got to fix thisā€¦

5 Likes
6

This happened again. Not a staged account this time, but a normal user getting support and including links. The spam trigger was correct this time (a new user posting links to the same domain), but we still ended up with 33 PMs in the moderator inbox. Consolodating those messages would be nice.

3 Likes
7

This happened again. Staged user signed up, received only 3 flags (not as bad as in the past), but caused a bit of confusion with the user.

1 Like
8

Maybe @featheredtoast can have a look; we get bitten by this regularly so the code needs to be improved.

Probably we need to better consider the dates the user ā€œjoinedā€ based on staging.

5 Likes
9

That sounds like a sane improvement; let me see what I can do here.

6 Likes
11

This is now merged: previously staged users will now be considered trusted users. :pear:

https://github.com/discourse/discourse/pull/6002

7 Likes
12

Weā€™re confident this has no security holes, e.g. you canā€™t game the system by mailing in, then immediately sign up to gain TL1 ā€œfor freeā€?

The main focus here is ensuring that the spam link check is improved.

2 Likes
13

I get your point, I misunderstood what we wanted to do here sorry - thatā€™s how it is right now (consider someone as a ā€œtrusted usersā€ if they come through staged.)

Iā€™ll improve this now - just to confirm, all we want is the spam host check to not trigger, but all other new user checks will still be in place, correct? (the other checks being: max links, max mentions, and max attachments)

1 Like
15

It might be safe ā€œenoughā€ if you gate it by time. What I object to is someone emailing team@discourse.org and then IMMEDIATELY signing up with that same email to gain trust level 1. Thatā€™s a straight up exploit.

16

OK Iā€™ve updated this - Now, they will still be considered tl0, but will not trigger the spam if the accounts were created more than 1 week ago to catch the ā€œlong email relationshipā€ cases. :banana:

https://github.com/discourse/discourse/commit/68e4e6a5755db4dd974eaeed73d5cfc517449b75

Do we want ā€˜time until discourse recognizes a mature staged userā€™ be an additional site setting, or is this sufficient barrier lowering?

6 Likes
17

I would say one day is probably fine and safe enough; itā€™s pretty easy to get from TL0 to TL1 if you know what you are doing.

5 Likes
18

OK, done - this should be good now :fish_cake:

https://github.com/discourse/discourse/commit/2ff226e5091f279ed2aa5b3e707a1acbd74f21fd

6 Likes