Watched words to block recent spam attack

[pfaffman (Jay Pfaffman)]

@pacharanero

The solution is to make it so that editing a post does not circumvent any site protections.

Agreed. It seems bizarre that it doesn’t work that way. And if I understand correctly it’s been broken for a long time.

Oh, it’s the “expected behavior”:

Watched Words not applying to post edits

We use “Require Approval” Watched Words to catch persistent spam domains. Spammers are now posting anodyne responses with no triggering words in them and then editing their posts to contain the spam link to a domain that is on our Watched Words list. Is it intended that Watched Words can be circumvented by post editing? I now note that this was asked and not answered (as far as I can tell) in the now-closed Watched word Approval doesn't work if a user edits the reply - #38 by physixfan

I bet this is how this came to be, maybe.

@RobMeade

I then searched the entire forum for some various words and found some posts which contained them. I edited the posts, replacing the word with asterisks. Having done this on about 4 posts I noticed that I now had four new flags!

It would seem that the version history of the post, which still contains the original word, is triggering a flag to be raised.

It seems like the watched words could just be applied before_save, but I haven’t looked at the code.