CUNY Academic Commons

Thanks, Scott -- we received a few notices about this today, including one from IT. Assigning to Boone.

Thanks for reporting, Scott.

After a good deal of investigation today, here's what I found. Starting yesterday, a spammer (or collection of spammers) figured out that it was possible to leave comments on certain BuddyPress Docs without being logged in. This is because of the 'anyone' setting in buddypress-docs, which must have had its behavior changed in a recent version. As such, they'd found a couple of 'anyone' Docs, and posted hundreds of spam comments to them. Because of a quirk in the way Docs handles comment approval - comments are assumed to be from trusted users, so are force-approved on submission - Akismet was recognizing them as spam, but not preventing them from being published. As such, each time the bots returned to those pages, it took longer for them to load, due to the large number of comments that needed to be rendered. Apache started running out of processes to spare, causing a resource bottleneck.

I took a couple immediate steps to resolve the problem:

1. I marked all of the problematic comments as spam. This fixed the resource issue.
2. I patched the Commons so that non-logged-in users could not post comments to Docs.

This evening, I put a more proper solution in BuddyPress Docs itself: https://github.com/boonebgorges/buddypress-docs/commit/45137eec2b0573b52b5c8e0736bbb101197fcd6f I then ported all recent changes from the Docs repo to the Commons: https://github.com/cuny-academic-commons/cac/commit/d00970ae887a6ce7deceb283cce24ca905b79656