Hallo,
I have (since some months) problems with a machine/robot which fills some pages with pure nonsense (and deletes sometimes the old contents).
MediaWiki 1.17.0
From the log file, from perhaps hijacked clients:
46.100.171.23 - - [22/Oct/2011:02:15:20 +0200] "GET /Wiki/index.php?title=Zusatzprogramme:kopiere&action=edit HTTP/1.1" 200 15984 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 46.100.171.23 - - [22/Oct/2011:02:15:34 +0200] "POST /Wiki/index.php?title=Zusatzprogramme:kopiere&action=submit HTTP/1.1" 302 - "http://arktur.de/Wiki/index.php?title=Zusatzprogramme:kopiere&action=edi..." "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 46.100.171.23 - - [22/Oct/2011:02:15:42 +0200] "GET /Wiki/index.php?title=Zusatzprogramme:kopiere HTTP/1.1" 200 11027 "http://arktur.de/Wiki/index.php?title=Zusatzprogramme:kopiere&action=edi..." "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 46.100.171.23 - - [22/Oct/2011:02:15:47 +0200] "GET /Wiki/index.php?title=Zusatzprogramme:kopiere HTTP/1.1" 200 10593 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.160.123.161 - - [22/Oct/2011:02:32:52 +0200] "GET /Wiki/index.php?title=Texte:Rembo-Installation&action=edit§ion=1 HTTP/1.1" 200 15440 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 203.160.123.161 - - [22/Oct/2011:02:32:57 +0200] "POST /Wiki/index.php?title=Texte:Rembo-Installation&action=submit HTTP/1.1" 302 - "http://arktur.de/Wiki/index.php?title=Texte:Rembo-Installation&action=ed..." "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 203.160.123.161 - - [22/Oct/2011:02:33:07 +0200] "GET /Wiki/index.php?title=Texte:Rembo-Installation HTTP/1.1" 200 41623 "http://arktur.de/Wiki/index.php?title=Texte:Rembo-Installation&action=ed..." "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" 203.160.123.161 - - [22/Oct/2011:02:33:14 +0200] "GET /Wiki/index.php?title=Texte:Rembo-Installation HTTP/1.1" 200 41183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
The "POST" operation shows the return level 302, but the page is changed.
I've included "ConfirmEdit" and "MathCaptcha" - doesn't help. Maybe "MathCaptcha" doesn't work ... Allowing write access only for registered users doesn't help.
Where's the hidden entry for this nasty robot?
Viele Gruesse! Helmut