ANONYMOUS PUBLISHING README.txt
===============================

This module increases your control over anonymous publishing on a
site.

Anonymous Publishing may lower the threshold for authorship and entry
to a site. It may also be a requirement for certain sites that deal
with sensitive issues that anonymous publishing is allowed.

In Drupal, the administrator may grant the anonymous user the right to
create new content (so you don't need this module to allow anonymous
users to create content). However, simply anonymous publishing may
have the side-effect of making the site wide open to spammers.

This module offer a number of features that gives the site
administrator more control over the anonymous publishing workflow.

The major features of Anonymous Publishing are:

1. Users may publish content without first registering an account at
   the site, provided they supply a vaild e-mail address and click on
   an activation link sent them in a verification e-mail (some call
   this the "craigslist model").

2. Authenticated users may publish content that appear to be published
   by Anonymous (i.e. they need to be authenticated and logged in to
   publish, but the content they tag as anonymous will never be
   publicly associated with their user name or other identity).

More specifically, it:
- lets anonymous publishers self-activate;
- allow anonymous publishers to edit or delete their content;
- retains self-activated e-mail addresses for future use;
- sends e-mail to moderators when anonymous content is created;
- provides simple moderation of content published anonymously;
- lets the administrator block abusers based upon e-mail and IP address;
- provides flood control;
- purges records that links the identifyer to specific content;
- lets the administrator customize the verification e-mail;
- allows authenticated users to publish as the anonymous user;

If you allow anonymous publishing your site will probably be targeted
by spammers, both of the human kind, and bots.  However, very few
spammers activate, so self-activation may be suffiscient to keep spam
at bay.  If you need more protection against spam, projects such as
Captcha, Riddler, SpamBot (and many others) may be good companions.


Installation
------------

+-------------------------------------------------------------------+
|  IMPORTANT:                                                       |
|  If you have installed a previous version of this module          | 
|  disable and *uninstall* it (use the "Uninstall" tab on the       |
|  Modules administration page) before installing this version.     |
|  Just disabling it will not work.                                 |
+-------------------------------------------------------------------+

During installation, the module will create a verified (but blocked)
anonymous robot account with the e-mail address "apu@example.net"
(unless a user with this e-mail already exists).  This robot account
has the default name "Anonymous", but you can change it to something
else (e.g. "a random drifter") if you like by editing this user's
profile.  Note by default, the robot account is unused.  However, you
may opt to make this robot account owner of anonymous postings instead
of the system default unverified account (user #0) if you do not want
the string "not verified" to appear after the anonymous posting user
names.

Do not change the e-mail address of the robot account.  This robot
account will not be removed when you uninstall the module (since nodes
may remain that refers to it).


Administration form
-------------------

After installing and activating the module navigate to
   Configuration > Content authoring > Anonymous publishing.

There are six tabs:

1. Main settings: All the main options for this module.
2. Message templates: Customize verificaton e-mail sent out.
3. Moderation: Moderate anonymously published content.
4. Blocking: Block (and unblock) users' e-mail addresses.
5. Real names: List real user names of content published as anomymous.
6. Privacy: Privacy enhancing settings.


Main settings

To set up anonymous publishing for a site, go to the settings tab and
select the content type (or types) that you will manage using this
module.  Not all content types are suitable for anonymous publishing.
For instance, the built-in "Blog entry" automatically link to the blog
belonging to the users.  The built-in "Article" type is suitable.

If you want to allow users that are not logged in to create content of
the types you set up the module to manage, you must also give
permission for the anonymous user to create content of the type in the
Admin -> People -> Permissions panel.

The rest of the settings on the settings page will only have an effect
on the type or types selected here.

Here is a brief description of the options:

- Allow self-activation.
  If you tick this option, content will be automatically published
  when the anonymous publisher verifies the e-mail.  Otherwise, the
  content will be flagged as verified, but will not be published until
  approved by a moderator.

- Send e-mail to the moderator when anonymous content is created.
  Ticking this will automatically send an e-mail to the moderator
  e-mail address whenever anonymous content is created.  You may
  use this to make sure the moderator becomes aware of possible
  problems (such as spam), or to speed up the moderation process
  (if you do not allow self-activation).

- Use IP-address for blocking.
  By default, the "blocking" box only applies to the e-mail used for
  authentication. The module records the IP-address used to
  authenticate, but this normally only used for flood control
  purposes.  When this option is set, the module will also block the
  corresponding IP-address.  Note that setting this option may result
  in false positives (as one IP-address may be shared between several
  users over time), so use this option with caution.

- Assign anonymously published nodes to the verified robot account.
  By default, Drupal makes nodes created by the anonymous user
  owned by user #0 and flags them as 'not verified'.  Setting this
  option assigns ownership to these nodes to a verified anonymous
  robot account created (if necessary) during installation.  

- Allow authenticated users to publish as 'Anonymous'.
  Ticking this will add an option to the create content for
  authenticated users, giving them the option to publish as
  'Anonymous'.

Moderator's e-mail address:

If you opt to send e-mail to the moderator when anonymous content is
created, you need to provide a vaild e-mail address for the moderator.

Verification e-mail address field weight: 

To control where on create content form the verification e-mail
address field is placed, you may specify a weight for this field.

Number of hours to retain anonymous posts before auto-deletions
removes it:

Spambots will automatically fill in any form that looks like its an
open submission form, but almost never act on the verification e-mail.
There is no point in keeping non-verified content around, so it is
automatically autodeleted after the number of hours you specify under
Main settings.  As a courtesy, you should inform vistors about this
auto-deletion limit. (N.I.)

Number of anonymous posts allowed from a single user e-mail/ip allowed
within an hour:

For flood control, you may set the number of anonymous posts allowed
from a single e-mail-address or ip-address within an hour from 1 -
98. Use 99 for no limit.

Remember to press "Save configuration" when done.


Message templates

In this panel, there are five fields that let the administrator
customize the e-mail message sent to non-authenticated users when they
create content. The first field is the subject, the rest of the fields
may go in the body. Other settings determine what fields are used.


Moderation

This panel shows all the nodes published anonymously that have been
verified by e-mail.  It lets the moderator publish or unpublish such a
node.


Blocking

This panels list all the e-mails and IP-addresses that has been
associated with anonymous publishing verified by e-mail and let you
block (or unblock) each individual one.

The IP-address is only used for blocking if you've ticked "Use
IP-address for blocking" under main settings.


Real names

This panels lists the real user names and subject lines of content
that published as anonymous.  It allows the administrator to identify
authenticared users that abuse the abilty to post as anonymous.

The rentention period of the user names listed here is controlled by
the settings under the privacy tab.


Privacy

While no e-mail address or username is made avialable to outsiders,
the e-mail adress or username associated with content is by default
retained indefinitely, and can be extracted from the database.  If
your site is used to publish sensitive material, you may want to limit
the period the record that links e-mails/usernames to specific content
is retained. (N.I.)

For a very sensitive site, you may want to set this to "Delete ASAP",
but you may also opt to retain for a limited time (from an hour up to
1 month) to give you some time to pick up the e-mail addresses or
IP-addresses of spammers and block them.  The purging of e-mail
adresses and usernames is done by cron, so you need to run cron at
least as often as half the maximum period set to be sure identifiers
are purged within the time limit.

The button "Purge" now bypasses cron and purges the identifiers
instantly.


Other administration
--------------------

If you want users that are not logged in to be able to create content,
you also need to navigate to:
   People > Permissions
and tick the following for the anonymous user:
- View published content
Then for each of the the content type(s) you want to allow anonymous
publishing for, tick the following for the Anonymous user:
- Create new content


Troubleshooting
---------------

The module uses a session cookie to keep track of anonymous
publishers.  Those who have cookies turned off or deleted or who uses
a different browser to verify may experience problems with viewing and
editing the nodes they've published anonymously.


ToDo
----

There are some boxes and fields in the admin form marked "N.I.".
The functionality you may set with these is not implemented yet.
They are just placeholders for future features.

More to do:
- QA and a lot of testing.

- Sanity checks.
  - If anonynous publishing is managing at least one content type:
    then: Self activation = 1 OR Allow auth. = 1
  - If Self activation = 1:
    then: Manage at least one content type and allow post by one
    content type.


Known glitches
--------------

- Some planned features are not yet implemented.


Please help
-----------

Any help (patches, reviews, comments) are welcome.



Release notes
-------------

7.x-1.0-alpha2 (2013-05-11):

- Adds a weight field (issue #1981546).
- Setting "View own unpublished content" for anonymous is no longer
  required (issue #1978726).

7.x-1.0-alpha1 (2013-04-10):

- First stable release.


Credits
-------

Anonymous Publishing was first created by dropcube (Ronny López).
The current maintainer for the Drupal 7 version is Gisle Hannemyr.
