Send-to form spammers

Ugh. Spammers are truly the bottom feeders of the internet. I discovered recently that my development site was being used to send unsolicited email. My sincerest apologies to anyone who got junk mail from an fprimex.com address.

I have fixed the problem, and outlined for other Plone users below some precautions to take so that they too don't get used to make the spam problem any worse.

The main issue is that Plone has a feature through which you can email a link to someone using an online form. It's a "I bet Bob would want to see this", click send-to, put Bob's email into the form, click send scenario. Unfortunately, this feature is available to anyone and can be repeatedly abused by scripts and lowlifes.

Here's a checklist to get rid of Plone's send-to functionality:

1. Take the "Allow sendto" permission away from everyone
   1. In the Zope Management Interface (ZMI) of your Plone site, select the "Security" tab.
   2. Scroll down to the "Allow sendto" permission and uncheck all of the boxes in its row, including "Acquire".
   3. This will make it so that people can still reach the sendto form, but when they attempt to send, they'll get an error. This is the minimum to fix the problem.
2. Remove the sendto document action
   1. In the ZMI of your Plone site, select portal_actions
   2. In portal_actions, select document_actions
   3. Either of these achieves the same effect for end users:
      1. Delete sendto
      2. Select sendto, then uncheck Visible
3. Replace the sendto_form page with a disabled message
   1. In the ZMI of your Plone site, select portal_skins
   2. Select the plone_forms folder
   3. Select the sendto_form, then click the Customize button
   4. In the template, delete the form and replace it with something like "This form has been disabled."

Note that doing only #2 will still allow spammers to reach and use the sendto form if they know the URL.