Removing rogue members from your Plone site

I recently had one of my Plone sites get hit by a "join form attack". Basically a spam bot which started adding new members to my site (we don't use a captcha at the moment). I ended up with far more members in the site than members of the organization. I started deleting them manually using the Zope Management Interface > acl_users > source_users, but that became tedious quickly. So I wrote a command-line script to do the job for me.

In my case the spambot wasn't super smart, all the usernames created by the bot started with capital letters. All my real users had usernames with common letters. This made it easy to filter out the bad guys.

Here's my script in a nutshell:
.
.

I used the special --object-path option to indicate the location of my Plone site, relative to the root of the Zope application server.

My final command looked something like this:

bin/instance_debug --object-path='pathto/sitein/zodb/plone' run member_cleanup.py > members_cleanup_report.txt

The resulting output went to a members_cleanup_report.txt.

Many thanks to the plone.api and plone.docs teams, being able to make use of plone.api.user made it 20 times easier to write the script.

A note about transactions

Before my script would run successfully I had to add a transaction.commit() line, it seems commandline scripts require this.

Parting thoughts

There's a lot more that can be added to the script to make it smarter. For example for certain kinds of sites you could filter based on whether the user has created any content or perhaps it might be based on log in patterns, if they have never logged in or only logged in once.

I'm weighing the pros and cons of having a captcha. At the moment members can't do much except change their portrait pictures and profiles, but I know that some spammers use the portrait for hosting "bad" images, so captchas may have to be introduced.

References

The resources I used included the following references:

http://docs.plone.org/external/plone.api/docs/api/user.html
http://docs.plone.org/develop/plone/misc/commandline.html#scripting-context
https://pypi.python.org/pypi/plone.recipe.zope2instance

Install Plone 5 Beta 4 on Cloud9 IDE in 5 minutes

(update August 27, 2015:  The script now installs Plone 5 Beta 4)
These are quick instructions for installing Plone 5 Beta 4 on Cloud9 IDE, they supercede my post on installing Plone 5 Beta 2. This walks you through the process of installing Plone on Cloud9 IDE as it is no longer possible to do this on the free tiers of Codio. We assume you have already signed up with Cloud9 IDE.

Step 1 - Create a new Workspace

On the Cloud9 IDE dashboard select Create a new workspace

Use the default settings as a Starting Point

Then click Create workspace.

Step 2 - Enter the installer command in the terminal

in the terminal type the following:

wget -qO- goo.gl/5FMjBC | bash

You will see output similar to this:

Step 3 - Launching Plone 5

After successful installation (takes about 5 minutes) run the following command:

cd zinstance
bin/instance fg

Once it has started successfully you'll see the following message on the terminal:

INFO Zope Ready to handle requests

At that point select Preview > View Running Application.

IMPORTANT: You'll need to get the adminPassword, it is located under the 'zinstance' folder see the screenshot below.

Once it's running, click on the "pop out" button

This will lead you to the Plone installer (it will look a little weird, because of an issue with proxying the site via https). Click on Create a new Plone site and following the instructions.

Once you're successful you'll see a running Plone 5 site:

Things to Know

Here are a few things to know about Plone.

1. Plone runs on an application server called Zope 
2. You can actually run multiple copies of Plone on one Zope application server

Next Steps

This quick cloud based installation is a great way to try out some of the new things in Plone 5. Plone 5 is still being polished so it will have rough edges. Try changing the look of your site by following these notes from Asko Soukka on customizing Plone 5's default theme.

If you get this working, please leave a comment. If you try and have issues leave a comment.