0

In my site anonymous users has access to create one type of content and all data the site stores is user IP address.

How do I limit lets say e.g. 2 nodes creations per IP in 12 hours? And when limit is reached, they get some message instead of creating another node until 12 hour range pass?

Because now some of anonymous users are just abusing and spamming the node creation which is unlimited by default.

UPDATE: I tried using Node Limit, but it doesn't really work. When I load a page with the form which has the limit set, it doesn't load the page and that's a home-page of the site and form is displayed as Form Block via Panels. So instead of a home-page I get redirected to node/add/ and page not found.

enter image description here

4

You could do it custom with hook_node_access and the Flood API.

e.g:

/**
 * Implements hook_node_access
 */
function MY_MODULE_node_access($node, $op, $account) {

    // Get node type, can be string or node object
    $type = is_string($node) ? $node : $node->type;
    if ($type == 'type_of_interest') {
      // Check flood limit for anon users node creation
      if ($op == 'create' && user_is_anonymous()) {
        // Ensure checked only once per page request, node/add path only
        $access_checked = &drupal_static(__FUNCTION__);
        if(empty($access_checked) && arg(0) == 'node' && arg(1) == 'add') {
          // Record the access check for drupal_static
          $access_checked = TRUE;
          // Check create_node limit of 2 per 12 hours
          // Note, you could make the threshold and window config variables.
          if(!flood_is_allowed('create_node', 2, 43200)){
            drupal_set_message(t('There is a node creation limit of 2 nodes per 12 hours. Please try again later.'), 'error');
            return NODE_ACCESS_DENY;
          }else{
            // Register the node create event to test against for 48 hours
            // Note, you could move this somewhere else to ensure the node is actually saved, e.g hook_node_insert
            flood_register_event('create_node', 172800);
          }
        }
      }
    }

  return NODE_ACCESS_IGNORE;

}
  • This. A thousand times this. – Clive Aug 13 '14 at 9:17
  • Thanks I will try this, but I do not understand that 48 hours part. – Optimus Prime Aug 13 '14 at 17:18
  • So on first try for a new unique never used IP it creates a node, but also prints the drupal_set_message. Also it hides the form, so no chance to create 2nd node within 12 hours. So looks like it almost work, since I'm no PHP guru, I got no idea what needs changing in the code. – Optimus Prime Aug 13 '14 at 18:13
  • @OptimusPrime it looks like you may have something else calling node_access as well on your install so it's called twice. The solution would be to add some code to ensure it's only checked once per page load (see updated answer) or alternatively, you may need to check the menu path to ensure it's run once on the target path only. – David Thomas Aug 13 '14 at 21:39
  • I think this code blocks entirely all anonymous for 2 nodes per 12 hours, in original question I meant 2 nodes per IP. I exceeded limit with one IP now, and with another I get the limit message. – Optimus Prime Aug 14 '14 at 7:39
0

You can use the Node Limit module

The Node Limit module allows administrators to restrict the number of nodes of a specific type that roles or users may create.

  • Per-role node limits
  • Per-user node limits
  • Hmm, will that really work with anonymous users and per IP? – Pontus Nilsson Aug 13 '14 at 7:29
  • Sure it will work for any user role, I have not checked for IP! – inizio Aug 13 '14 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.