=== Sabre ===
Contributors: dlo
Donate link:
Tags: spam, admin, registration, antispam, anti-spam
Requires at least: 2.5
Tested up to: 2.7.0
Stable tag: 0.8.0

Sabre is an acronym for Simple Anti Bot Registration Engine.
It's a set of counter measures against spam registration on your blog.

== Description ==

Sabre is an acronym for Simple Anti Bot Registration Engine.
It's a set of counter measures against spam registration on your blog.

Your visitors are granted permission to register freely on your blog and now you are plagued by fake users automatically created by spammers? Sabre is the solution to stop definitely these robotized visitors!

List of available features:

1. Inclusion of a captcha in the registration form 
1. Selection of the captcha's complexity
1. Selection of the background colour for the captcha image 
1. Inclusion of a math test in the registration form 
1. Selection of the math test's complexity 
1. Random or fixed choice of the test to run 
1. Unobstrusive tests to detect if registration is done by humans or not 
1. Registration blocked if Javascript is unsupported by the browser 
1. Registration blocked if visitor's IP address is found on ban lists
1. The blog administrator can validate the user registration 
1. The user can validate his registration by clicking on a link sent by mail 
1. Limited number of days for user confirmation. Without beeing confirmed within the period of time, the user account is disabled 
1. Log on prohibited before user confirmation 
1. User is allowed to choose his password when registrating on the blog
1. User must agree with a warning text, disclaimer or general policy note when registrating
1. User must give an invitation code during registration  
1. Main statistics displayed on the blog's dashboard
1. Custom logo on logon/registration screen
 
All these features are activated by parameters. Thus, Sabre is flexible enough and fits the protection policy you define for your blog.

NOTE 1:
If you're using an earlier version of WordPress, install Sabre 0.6.3 as Sabre 0.8.x is only compatible with WordPress 2.5 and up .

NOTE 2:
If you are upgrading from a previous install, don't forget to deactivate Sabre before overwriting the older files with the new ones. Then activate it again so Sabre can apply the required database and options updates.

== Installation ==

1. download the archive
1. unzip and drop all the files, as is, in your plugins/sabre directory.
1. Enable the plugin in the WP Admin >> Plugins section.
1. Change the parameters in the WP Admin >> Manage >> Sabre tab. 
1. Other languages
Sabre is delivered in English and French but can be easily used with other languages. You just have to create a file sabre-xx_YY.po (xx_YY being the language code of your WordPress settings. Eg: fr_FR for French) from the existing file sabre.pot using PoEdit. Then, just translate the text strings located after the "msgid" tag and put the translated string after the "msgstr" tag.
The resulting sabre-xx_YY.mo file has to be stored in the sabre/languages directory.
Alternatively, you can find the translation files (.mo et .po) of some languages in the FAQ page.


If you are upgrading from a previous install, don't forget to deactivate Sabre before overwriting the older files with the new ones. Then activate it again so Sabre can apply the required database and options updates.

== Frequently Asked Questions ==

= What are the required components for Sabre ? =

In order to run, Sabre needs the following:

- PHP 4.3.2 or higher
- GD 2.0.2 or higher
- and WordPress 2.5

If you're using an earlier version of WordPress, install Sabre 0.6.3 as Sabre 0.8.x is only compatible with WordPress 2.5 and up . 

= Where can I find a translation of Sabre in my own language ? =

Ready-to-use translation files are available in :

1. [Danish](http://mads.eu/wp-plugins#sabre) (thanks to Mads Christian Jensen)
1. [Spanish](http://www.faltantornillos.net/proyectos/gnu/otros/sabre-es_ES.tar.gz) (thanks to Daniel)
1. [Finnish](http://systemshed.com/sabre/sabre_fi_FI.zip) (thanks to Kimmo Sinkko)
1. [German](http://matthiaskoch.net/?p=37) (thanks to Matthias Koch)
1. [Polish](http://dev.m1chu.eu/index.php?title=Polska_translacja_Sabre) (thanks to m1chu)

If you can't find the files for your language, you can create them yourself with the sabre.pot file included in the package and PoEdit.


= I just installed Sabre and now the users already registered can't log in anymore. What's going wrong ? =

You decided to activate the registration confirmation and the users registered before Sabre's installation received the following message when they try to log in : "ERROR : Invalid registration status". This is because Sabre considers they have not confirmed their registration. You need to go to  Manage >> Sabre >> Approved registrations  and manually register each user giving his WordPress account ID and clicking on "Add" under "Manual registration".

= I'm fond of numbers. How can I display some figures about Sabre on my blog ? =

You can activate the "Show on dashboard" parameter in Sabre's administration screen to display basic figures like number of registrations blocked, approved and pending confirmation on the dashboard of your blog.

Another possibility is to show up the number of blocked spam bots on the registration form by clicking on the "Show banner" parameter.

The third way is to use Bernhard Riedl's [GeneralStats](http://wordpress.org/extend/plugins/generalstats/) plugin that integrates Sabre's figures among other useful informations about your blog's activity.


== Screenshots ==

1. Registration form with captcha added and custom password choice
2. Registration form with math test added and custom password choice
3. The dashboard widget

== Documentation ==

All the functions of Sabre are located in the Manage >> Sabre tab of the administration environment.

Sabre interface is divided into five tabs:

**1) "General options"**

First, some numbers related to valid, invalid and pending confirmation registrations are displayed.

Then, you can find the parameters of Sabre:

1a) Captcha Options

Click on the checkbox "Activate captcha" to display, in the registration form , a characters string that the user will have to copy back.

The other captcha's parameters will let you define the string's length, valid characters used to generate the random string  as well as the background colour of the image, number and type of graphic objects used to "blur" the string.

The captcha is based on QuickCaptcha 1.0 from Web 1 Marketing, Inc released under GNU GPL.

1b) Math Options

Click on the checkbox "Activate math test" to display, in the registration form , an arithmetic operation. The user will have to give the result.

The other parameter let you define the valid operations the plugin will choose from. Recognized operations are addition, substraction and multiplication. The plugin will choose randomly two numbers between 1 and 20 and one of the listed operations.

1c) Sequence of tests

Select "All" to add all the active tests in the registration form.

Select "Randomly" and the plugin will choose one of the tests, active or not.

1d) Stealth Options

Click on the checkbox "Enable stealth test" to activate a set of internal tests that try to detect if the current registration is done by a human being or not. These tests doesn't interact with the user and run undetected for a regular human registration.

These tests include the following:

* Control that the registration form is loaded before the answer is sent to the server.
* Control that the IP adress of the requester is the same when the form is sent back.
* Control that the browser used to register has Javascript capabilities as many spambots lack them. You can choose to reject the registration in such case, clicking on the checkbox "Block if Javascript unsupported".
* Control that the Javascript capability is not faked.
* Control that the registration is done within a maximum period of time. You can set this period (in seconds) under "Session time out". Try to maintain this number as low as possible for security reasons but high enough to let a human fill the registration form. Default value is 5 minutes (300 seconds).
* Control that the registration form is possibly filled by a human, in a minimum amount of time. A spambot will spend very little time to fill the form and send it to the server compared with human possibilities. You can set this minimum amount of time (in seconds) under "Speed limit". Default value is 5 seconds.
* Control that IP address is not banned by DNSBL servers. You can turn on/off this control, clicking on the checkbox "Check DNS Blacklists".   

1e) Confirmation Options

Select the correct item on the dropdown list "Activate confirmation" to force the user or the blog administrator to confirm the registration on your blog.

* **None**: No confirmation is required. (default)
* **By user**: User must confirm his registration. When this option is activated, the registering user will receive his user id and password by mail as usual. He is also asked to  confirm his registration within x days following  a link added to the mail. During this period of time, the user account is waiting for the confirmation but usable to connect to the blog. If the confirmation is not done in the due time,  the account will become unusable.
* **By admin**: The registration needs the administrator's confirmation to be activated. When this option is activated, the registering user will receive his user id and password by mail as usual but the account is not usable to connect to the blog until administrator's validation. Upon confirmation, a mail is sent to the user.

The next three parameters are effective only if user confirmation is required.

Number of days lets you give a period of time (in days) for the user to confirm his registration before the account becomes unavailable.

By clicking on the "Deny early sign-in" checkbox, you can prevent the connection of the new user until confirmation of his registration.

If you want to receive a mail whenever a user confirms its registration, click on the "Send mail when confirmed" checkbox.

If you want to suppress automatically the user account created by WordPress when the registration is cancelled, just click on the "Suppress unregistered users" checkbox. This option will be taken into account either in a manual cancelation or in case of exceeded period of time. Keep in mind that all the posts and links owned by the suppressed user account will be deleted as well.

IMPORTANT : The users with "edit_users" capability will not be controled. Then, it is always possible to use the default admin account created by WordPress during the blog installation.

1f) Policy Options

Click on the checkbox "Enable policy agreement" to force the user to acknowledge the fact that he read the rules of use of your blog before registration.

Give a title to your text block filling the "Policy name" input box. You can choose names like Disclaimer, Licence agreement, General policy, etc...

Write down the text of your disclaimer in the "Policy text" input box. Just write plain text. HTML tags are not allowed. 

1g) Invitation Options

Click on the checkbox "Enable invitation" if you want to control who can register on your blog by asking the user to give his invitation code during registration.

Fill the "Invitation codes" input box with the valid invitation codes you want. Example : PROMOETE2008, SZ78PQR, etc...
Each code must be on a single line. Then, you can communicate those codes to the persons who will be allowed to register on your blog.

Give a title to your text block filling the "Policy name" input box. You can choose names like Disclaimer, Licence agreement, General policy, etc...

Write down the text of your disclaimer in the "Policy text" input box. Just write plain text. HTML tags are not allowed. 

1h) Miscellaneous Options

Click on the checkbox "User password" to let the user choose his own password during the registration process. Otherwise, WordPress will generate a random password. The password strength is displayed in real time to help the user to choose a strong and safe password.

Click on the checkbox "Show banner" to add a reference and a link to Sabre's site at the bottom of the registration form. It's up to you to decide if you want to advertise Sabre or not !

Click on the checkbox "Show on dashboard" to add a widget on the dashboard with the main statistics about Sabre.

Click on the checkbox "Suppress Sabre" if you want to delete all information created by Sabre (table and options) when deactivating the plugin. 
CAUTION : Use this option only if you decided to stop using Sabre or if you want to purge the table and reset all the options to their default values. 

Don't forget to click on "Save options" to store your changes.

**2) "Blocked Registrations" Tab**

List the invalid registrations with the cause of error. The number of new registrations blocked since your last visit is shown between parenthesis on the tab.

It's possible to suppress the log giving the number of days to retain (20 days by default) and clicking on "Delete". You can ask Sabre to do it automatically, from now on, with the same period by clicking on the checkbox. A null or negative number of days with the checkbox ticked will prevent Sabre from doing the automatic cleanup. To suppress the log for a specific period of time without modifying the parameter of the automatic cleanup, just type the number of days to retain, untick the checkbox and press "Delete".

**3) "Approuved Registrations" Tab**

List the registration definitively accepted (status = ok). The user id created is displayed and gives access to its data by just clicking on it. The number of new accepted registrations since your last visit is shown  between parenthesis on the tab.

It's also possible to register manually a user giving his WordPress account name or all existing WordPress users clicking on the checkbox then pressing the "Add" button.

To cancel the registration of users, just click on the corresponding checkbox in the list, then press the "Unregister" button.

**4) "Registrations to confirm" Tab**

List the registration waiting for confirmation (status = to confirm). The user id created is displayed and gives access to its data by just clicking on it. The number of new registrations to confirm since your last visit is shown  between parenthesis on the tab.

If the confirmation must be done by the blog administrator, the following two buttons are available:

* Confirmation of the registrations is done by selecting the accounts in the list, then pressing the "Confirm" button.
* Refusal of the registrations is done by selecting the accounts in the list, then pressing the "Refuse" button.

**5) "About" Tab**

A wise text about the author and his work. A must-read you can't resist to !

**6) Custom image in logon/registration screen**

To change the default logo, copy your own image file in the /images directory of Sabre plugin. The file must be a 290pixels x 66pixels GIF file named sabre-login.gif

== History ==
**v. 0.8.0**

* Added parameter to activate invitation codes
* Added custom logo in logon/registration screen
* Plugin is now compatible with WordPress 2.7
* Plugin totally rewritten in object oriented PHP
* Message management reviewed to support plural form  

**v. 0.7.4**

* Corrected bug in automatic suppresion of the blocked registrations log. A value of zero or less days will now stop Sabre's automatic cleanup.
 
**v. 0.7.3**

* Added parameter to choose between black or white background for the captcha image.
* Added parameter to ask the user to read and agree with the general policy rules of the blog before registration.
* Sabre has been made compliant with the possibility offered by WordPress 2.6 to move the wp-content directory to a custom location.

**v. 0.7.2**

* Added parameter to let the blog admin validate the user registration.
* Revised admin interface for the management of registrations to confirm.
* Added tab "Registrations to confirm".

**v. 0.7.1**

* Added parameter to display Sabre statistics on the dashboard of the blog.
* Added parameter to let the user choose his own password during registration.

**v. 0.7.0**

* This version requires WordPress 2.5 and can't be used with previous versions of WordPress.
* Administration panel has been reworked to stick with the new WordPress admin interface.
* Manual registration of an existing user done by name and no longer by user ID as WordPress 2.5 no longer shows the user ID.
* Added parameter to receive a mail upon confirmation of registration by a user.

**v. 0.6.3**

* Small adjustments done to comply with WordPress 2.3.3

**v. 0.6.2**

* Added parameter to check if IP address is banned by DNSBL servers.
 
**v. 0.6.1**

* Change the Sabre table definition as some MySql versions doesn't allow text columns to have default value. This was preventing the creation of the table during Sabre initialization in some occasion.

**v. 0.6.0**

* Added parameter to delete WordPress account automatically when registration is canceled, either manually or because of exceeded period of time. 
* Added parameter to insert a reference to Sabre at the bottom of the registration form.
* Added parameter to select the number of days for automatic purge of history log.
* Added parameter to delete all information about Sabre when deactivating the plugin. This will clean your WordPress blog of tables and options created by Sabre, if you decide to stop using Sabre.  
* Performance improvement bypassing the tests if errors already detected before calling Sabre (eg. user name and/or mail missing)
* Performance improvement by code optimization
* Reinforced access security to the administration panels of Sabre using wp_nonce_field

**v. 0.4.2**

* Corrected bug in the storage of the number of days for registration's confirmation
	
**V. 0.4.1**

* Added parameter to deny/authorize newly registered users to sign in before registration is confirmed.
* Added the possibility to automatically register all existing WordPress accounts.
* Added several messages to give the status of operations done. 

**v. 0.4.0**

* Added several new internal tests to make Sabre more efficient in spambot detection. Those tests run undetected for regular human registrars.
* Those new tests are: 
* Control that the registration form is loaded before the answer is sent to the server.
* Control that the IP adress of the requester is the same when the form is sent back.
* Control that the browser used to register has Javascript capabilities as many spambots lack them.
* Control that the Javascript capability is not faked.
* Control that the registration is done within a maximum period of time.
* Control that the registration form is possibly filled by a human, in a minimum amount of time.
* Changed the way to control who can bypass the registration confirmation : Sabre now tests the "edit_users" capability and no longer the user level. This will ensure that all accounts with a high level of rights will always be able to sign in.

**V. 0.2.2**

* Code optimized and splitted in various files to reduce server loading.
* Automatic cleanup enhanced. 

**V. 0.2.1**

* Added a possibility to include the test randomly in the registration form. Added manual suppression of logs.

**V. 0.1.1**

* First public version