README.txt
==========

This module increases your control over anonymous publishing on a
site.

Anonymous Publishing may lower the threshold for authorship and entry
to a site. It may also be a requirement for certain sites that deal
with sensitive issues that anonymous publishing is allowed.

In Drupal, the administrator may grant the anonymous user the right to
create new content (so you don't need this module to allow anonymous
users to create content). However, simply anonymous publishing may
have the side-effect of making the site wide open to spammers.

This module offer a number of features that gives the site
administrator more control over the anonymous publishing workflow.

The major features of Anonymous Publishing are:

1. Users may publish content without first registering an account at
   the site, provided they supply a vaild email address and click on
   an activation link sent them in a verification email (some call
   this the "craigslist model").

2. Authenticated users may publish content that appear to be published
   by anonymous (i.e. they need to be authenticated and logged in to
   publish, but the content they tag as anonymous will never be
   publicly associated with their user name or other identity).

3. The moderator may set a pseudonym to be used as a byline override
   for any node.  For instance, an editor may receive a contribution
   by email from someone named "John Brown" who is not a registered
   user.  After publishing the node with his own byline, the editor
   can override this and set "John Brown" as teh displayed byline.

More specifically, it:
- lets anonymous publishers self-activate;  
- retains self-activated e-mail addresses for future use;
- lets anonymous publishers set a byline; (N.I.)
- sends e-mail to moderators when anonymous content is created;
- provides simple moderation of content published anonymously;
- lets the administrator block abusers based upon email and IP address;
- provides flood control;
- purges records that links the e-mail identity to specific content;
- lets the administrator customize the verification e-mail;
- allows authenticated users to publish as the anonymous user.
- provides a means for the administrator to override bylines.

If you allow anonymous publishing your site will probably be targeted
by spammers, both of the human kind, and bots.  However, very few
spammers activate, so self-activation may be suffiscient to keep spam
at bay.  If you need more protection against spam, projects such as
Captcha, Riddler, SpamBot (and many others) may be good companions.

Project pages for spam protection modules:
- http://drupal.org/project/captcha
- http://drupal.org/project/riddler
- http://drupal.org/project/spambot


Installation
------------

If you have installed a previous development snapshot of this module,
disable and uninstall it (use the "Uninstall" tab on the Modules
administration page) before installing this version.  Just disabling
it will probably not work.

During installation, the module will create a verified anonymous robot
user with the e-mail address "apu@example.net" (unless a user with
this e-mail already exists).  This robot user has the default name
"Anonymous", but you can change it to something else (e.g. "a random
drifter") if you like.  This user is used to make sure that
authenticated users that publish as anonymous does not have their
identity accidentally exposed by some Drupal magic linking a node to
its creator.

Do not change the e-mail address of this user.  This robot user will
not be removed when you uninstall the module (since nodes may remain
that refers to it).


Administration form
-------------------

After installing and activating the module navigate to
   Configuration > Content authoring > Anonymous publishing.

There are six tabs:

1. Main settings: All the main options for this module.
2. Message templates: Customize verificaton e-mail sent out.
3. Privacy: Privacy enhancing settings.
4. Moderation: Moderate anonymously published content.
5. Blocking: Block (and unblock) users' e-mail addresses.
6. Bylines: Set (and unset) byline overrides.


Main settings

To set up anonymous publishing for a site, go to the settings tab and
select the content type (or types) that you will mange using this
module.  Some content types (such as "Blog entry") automatically 
links to the users blog and is not suitable for anonymous publishing.
The built-in "Article" type is suitable.  Rememember to also give
permission for the anonymous user to create content of this type
in the Admin -> People -> Permissions panel.

The rest of the settings on the settings page will only have an effect
on the type or types selected here.

Here is a brief description of the options:

- Allow self-activation.
  If you tick this option, content will be automatically published
  when the anonymous publisher verifies the email.  Otherwise, the
  content will be flagged as verified, but will not be published until
  approved by a moderator.

- Use IP-address for blocking.
  By default, the "blocking" box only applies to the e-mail used for
  authentication. The module records the IP-address used to
  authenticate, but this normally only used for flood control
  purposes.  When this option is set, the module will also block the
  corresponding IP-address.  Note that setting this option may result
  in false positives (as one IP-address may be shared between several
  users over time), so use this option with caution.

- Let anonymous publisher set a byline. (N.I.)
  Usually, anonymous content is published with a default byline
  (e.g. 'Anonymous').  Tick this option if you want the anonymous
  publisher to be allowed to set a different byline. (There is no way
  for a verified user to set a byline themselves, but an administrator
  may do this.)

- Send e-mail to the moderator when anonymous content is created.
  Ticking this will automatically send an email to the moderator
  e-mail address whenever anonymous content is created.  You may
  use this to make sure the moderator becomes aware of possible
  problems (such as spam), or to speed up the moderation process
  (if you do not allow self-activation).

- Let the 'verified' anonymous user own anonymously published nodes.
  By default, Drupal makes nodes created by the anonymous user
  owned by user 0 and flags them as 'not verified'.  Setting this
  option assigns ownership to these nodes to a verified anonymous
  robot user created (if necessary) during installation.  

- Allow authenticated users to publish as 'Anonymous'.
  Ticking this will add an option to the create content for
  authenticated users, giving them the option to publish as
  'Anonymous'.

Moderator's e-mail address:

If you opt to send e-mail to the moderator when anonymous content is
created, you need to provide a vaild e-mail address for the moderator.

Verification e-mail address field weight: 

To control where on create content form the verification e-mail
address field is placed, you may specify a weight for this field.

Number of hours to retain anonymous posts before auto-deletions
removes it:

Spambots will automatically fill in any form that looks like its an
open submission form, but almost never act on the verification e-mail.
There is no point in keeping non verified content around, so it is
automatically autodeleted after the number of hours you speciy under
Main settings.  As a courtsy, you should inform vistors about this
auto-deletion limit if you use it.  Use 0 for no limit.

For flood control, you may set the number of anonymous posts allowed
from a single email-address or ip-address within an hour from 1 -
98. Use 99 for no limit.

Remember to press "Save configuration" when done.


Message templates

In this panel, there are five fields that let the administrator
customize the email message sent to non-authenticated users when they
create content. The first field is the subject, the rest of the fields
may go in the body. Other settings determine what fields are used.


Privacy

While no e-mail address is made avialable to outsiders, the email
adress associated with content is by default retained indefinitely,
and can be extracted from the database.  If your site is used to
publish sensitive material, you may want to limit the period the
record that links verification e-mail to specific content is
retained. (N.I.)

For a very sensitive site, you may want to set this to "Delete ASAP",
but you may also opt to retain for a limited time (from an hour up to
1 month) to give you some time to pick up the e-mail addresses or
IP-addresses of spammers and block them.  The purging of email
adresses is done by cron, so you need to run cron at least as often as
half the maximum period set to be sure e-mail addresses is purged
within the time limit.

The button "Purge" now bypasses cron and purges the e-mail records
instantly.

Moderation

TBA


Blocking

This panels list all the e-mails and IP-addresses that has been
associated with anonymous publishing and let you block (or unblock)
each individual one.  The IP-address is only used for blocking if
you've ticked "Use IP-address for blocking" under main settings.


Bylines


TBA


Other administration
--------------------

If you want users that are not logged in to be able to create content,
you also need to navigate to:
   People > Permissions
and tick the following for the anonymous user:
- View published content
Then for each of the the content type(s) you want to allow anonymous
publishing for, tick the following for the Anonymous user:
- Create new content


Troubleshooting
---------------

[TBA]


ToDo
----

There are some boxes and fields in the admin form marked "N.I.".
The functionality you may set with these is not implemented yet.
They are just placeholders for future features.

More to do:
- QA and a lot of testing.

- Sanity checks.
  - If anonynous publishing is managing at least one content type:
    then: Self activation = 1 OR Allow auth. = 1
  - If Self activation = 1:
    then: Manage at least one content type and allow post by one
    content type.


Known glitches
--------------

- Some planned features are not yet implemented.


Please help
-----------

Any help (patches, reviews, comments) are welcome.



Release notes
-------------

7.x-1.0-alpha2 (2013-05-11):

- Adds a weight field (issue #1981546).
- Setting "View own unpublished content" for anonymous is no longer
  required (issue #1978726).

7.x-1.0-alpha1 (2013-04-10):

- First stable release.


Credits
-------

Anonymous Publishing was first created by dropcube (Ronny López).
The current maintainer for the Drupal 7 version is Gisle Hannemyr.
