Anonymous Publishing

The Anonymous Publishing module increases your control over anonymous publishing on a site.

The primary purpose of this module is to lower the threshold for authorship and entry to a site. It may also be used to facilitate anonymous publishing on certain sites that deal with sensitive issues..

In Drupal, the administrator may grant the anonymous user the right to create new content (so you don't need this module to allow anonymous users to create content). However, simply anonymous publishing may have the side-effect of making the site wide open to spammers.

This module offer a number of features that gives the site administrator more control over the anonymous publishing workflow.

The major features of Anonymous Publishing are:

1. Users may publish content without first registering an account at the site, provided they supply a vaild e-mail address and click on an activation link sent them in a verification e-mail (some call this the "craigslist model").
2. Authenticated users may publish content that appear to be published by anonymous (i.e. they need to be authenticated and logged in to publish, but the content they tag as anonymous will never be publicly associated with their user name or other identity).

More specifically, it:

• lets anonymous publishers self-activate;
• retains self-activated e-mail addresses for future use;
• allows authenticated users to publish as the anonymous user;
• sends e-mail to moderators when anonymous content is created;
• provides simple moderation of content published anonymously;
• lets the administrator block abusers based upon e-mail and IP address;
• provides flood control;
• purges records that links the e-mail/username identity to specific content;
• lets the administrator customize the verification e-mail.

If you allow anonymous publishing your site will probably be targeted by spammers, both of the human kind, and bots. However, very few spammers activate, so self-activation may be suffiscient to keep spam at bay. If you need more protection against spam, projects such as Captcha, Riddler, SpamBot, (and many others) may be good companions.

Installation

Install the anonymous_publishing module directory in the directory where you keep contributed modules (e.g. sites/all/modules/).

Go to the Modules page and enable the Anonymous Publishing module.

After enabling the module, you need to configure it for it to have any effect. See the section titles Administration form below for a description of the configuration settings.

During installation, the module will create a verified anonymous robot user with the e-mail address "apu@example.net" (unless a user with this e-mail already exists). This robot user has the default name "Anonymous", but you can change it to something else (e.g. "a random drifter") if you like.

Do not change the e-mail address of this user. This robot user will not be removed when you uninstall the module (since nodes may remain that refers to it).

Administration form

After installing and activating the module navigate to: administer » Configuration » Content authoring » Anonymous publishing.

There are six tabs:

1. Main settings: All the main options for this module.
2. Message templates: Customize verificaton e-mail sent out.
3. Privacy: Privacy enhancing settings.
4. Moderation: Moderate anonymously published content.
5. Blocking: Block (and unblock) users' e-mail addresses.
6. Real names: List real user names of content published as anomymous.

Main settings

To set up anonymous publishing for a site, go to the settings tab and select the content type (or types) that you will mange using this module. Some content types (such as "Blog entry") automatically links to the users blog and is not suitable for anonymous publishing. The built-in "Article" type is suitable.

When you enable anonymous publishing for a content type. rememember to also give permission for the anonymous user to create content of this type in the administer » People » Permissions panel.

The rest of the settings on the settings page will only have an effect on the type or types selected here.

Here is a brief description of the options:

• Allow self-activation.
  If you tick this option, content will be automatically published when the anonymous publisher verifies the e-mail. Otherwise, the content will be flagged as verified, but will not be published until approved by a moderator.
• Use IP-address for blocking.
  By default, the "blocking" box only applies to the e-mail used for authentication. The module records the IP-address used to authenticate, but this normally only used for flood control purposes. When this option is set, the module will also block the corresponding IP-address. Note that setting this option may result in false positives (as one IP-address may be shared between several users over time), so use this option with caution.
• Let anonymous publisher set a byline. (N.I.)
  Usually, anonymous content is published with a default byline (e.g. 'Anonymous'). Tick this option if you want the anonymous publisher to be allowed to set a different byline. (There is no way for a verified user to set a byline.)
• Send e-mail to the moderator when anonymous content is created.
  Ticking this will automatically send an e-mail to the moderator e-mail address whenever anonymous content is created. You may use this to make sure the moderator becomes aware of possible problems (such as spam), or to speed up the moderation process (if you do not allow self-activation).
• Let the 'verified' anonymous user own anonymously published nodes.
  By default, Drupal makes nodes created by the anonymous user owned by user 0 and flags them as 'not verified'. Setting this option assigns ownership to these nodes to a verified anonymous robot user created (if necessary) during installation.
• Allow authenticated users to publish as 'Anonymous'.
  Ticking this will add an option to the create content for authenticated users, giving them the option to publish as 'Anonymous'.

There are also some fields that may be filled in with data. These are described below:

• Moderator's e-mail address:
  If you opt to send e-mail to the moderator when anonymous content is created, you need to provide a vaild e-mail address for the moderator.
• Verification e-mail address field weight:
  To control where on create content form the verification e-mail address field is placed, you may specify a weight for this field.
• Number of hours to retain anonymous posts before auto-deletions removes it:
  Spambots will automatically fill in any form that looks like its an open submission form, but almost never act on the verification e-mail. There is no point in keeping non-verified content around, so it is automatically autodeleted after the number of hours you specify under Main settings. As a courtesy, you should inform vistors about this auto-deletion limit if you use it. Use 0 for no limit.
• Number of anonymous posts allowed from a single user e-mail/ip allowed within an hour:
  For flood control, you may set the number of anonymous posts allowed from a single e-mail-address or ip-address within an hour from 1 - 98. Use 99 for no limit./li>

Remember to press "Save configuration" when done.

Message templates

In this panel, there are five fields that let the administrator customize the e-mail message sent to non-authenticated users when they create content. The first field is the subject, the rest of the fields may go in the body. Other settings determine what fields are used.

Moderation

This panel shows all the nodes published anonymously that have been verified by e-mail. It lets the moderator publish or unpublish such a node.

Blocking

This panels list all the e-mails and IP-addresses that has been associated with anonymous publishing and let you block (or unblock) each individual one. The IP-address is only used for blocking if you've ticked "Use IP-address for blocking" under main settings.

Real names

This panels lists the real user names and subject lines of content that published as anonymous. It allows the administrator to identify authenticared users that abuse the abilty to post as anonymous.

The rentention period of the user names listed here is controlled by the settings under the privacy tab.

Privacy

While no e-mail address or username is made avialable to outsiders, the e-mail adress or username associated with content is by default retained indefinitely, and can be extracted from the database. If your site is used to publish sensitive material, you may want to limit the period the record that links e-mails/usernames to specific content is retained. (N.I.)

For a very sensitive site, you may want to set this to "Delete ASAP", but you may also opt to retain for a limited time (from an hour up to 1 month) to give you some time to pick up the e-mail addresses or IP-addresses of spammers and block them. The purging of e-mail adresses and usernames is done by cron, so you need to run cron at least as often as half the maximum period set to be sure identifiers are purged within the time limit.

The button "Purge" now bypasses cron and purges the identifiers instantly.

Other administration

If you want users that are not logged in to be able to create content, you also need to navigate to: People » Permissions and tick the following for the anonymous user: View published content. Then for each of the the content type(s) you want to allow anonymous publishing for, tick the following for the Anonymous user: Create new content.