Originally Posted by Fungsten (Post 1670249)

Im getting the subscription error too.

Originally Posted by MrEyes (Post 1670137)

Good mod, fantastic idea, however the subscription issue is something of a show stopper. So I decided to look into it.

The reason the "firewall" quick in on the subscription page is that one of the security rules is 'script', and quiet rightly so. However due to the checking method used the firewall kicks in when it sees:

do=viewsubscription

Notice the bold/underlined part

The good news is that this can be resolved, but it is a hack to the mod. The following instructions explain what needs to be done, if you want to implement it then I strongly recommend first testing it on an test server. Hopefully this will help the mod dev makes this mod one of the best available here:

Right, you need to goto:

ACP -> Plugins & Products -> Plugin Manager

Once there look for the entries for "Product : vBFirewall", this should only have one plugin called 'vBFirewall' which uses the 'init_startup' plugin. Click edit

Copy all the text in 'Plugin PHP Code' into notepad.

Now follow these steps:

• Find the line that reads:
  
  
  Code:

  ---

  'st=-', 'cat%20', 'include', '_path=');

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $securityexclusions = array(
        'do=viewsubscription'
);

  ---

• Find the line that reads:
  
  
  Code:

  ---

  $cracker = strtolower($cracker);

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $cracker= str_replace($securityexclusions, '', $cracker);

  ---

Once done, copy all the edited text in notepad back into the 'Plugin PHP Code' in ACP, then click save

What this is actually doing is creating an extendible security rule exclusion list, so if any other VB queries string invoke the vbFirewall you can add another exclusion.

IMPORTANT : I have only run this on a basic test server I have, do not try this unless you are absolutely comfortable with plugins/php etc.

A here are some suggestions for the next version:

• Rather than add the logs to a flat file on the server store this in the DB and then create an ACP page to view/search/manage logs
• Add option to send a PM or Email or both
• If a specific IP invokes the firewall more than X times in Y seconds/minutes auto place this IP on the vBulletin ban list.
• If a specific IP can be associated to an actual forum user account auto ban that user.

One other teeny weeny little thing, you need to mention that this is based on the GPL licensed code found here : http://www.cback.de/cback_software/standalonect.php ;)

Originally Posted by TheLastSuperman (Post 1670279)

did you look above before posting????



Sorry to be so blunt but up top lol ^

THANKS to Invisiblea and MrEyes ;)

Originally Posted by Fungsten (Post 1670282)

I have to check my glasses.

Originally Posted by 7lanet (Post 1670436)

i try used this with Version 3.7
but hake vbAnonymizer

And also used vbAnonymizer
But at the entry of any link

Originally Posted by 7lanet (Post 1670436)

i try used this with Version 3.7
but hake vbAnonymizer

And also used vbAnonymizer
But at the entry of any link

Originally Posted by 7lanet (Post 1670436)

i try used this with Version 3.7
but hake vbAnonymizer

And also used vbAnonymizer
But at the entry of any link

Originally Posted by Fungsten (Post 1670694)

Same here.

Originally Posted by dtv100 (Post 1670246)

another error i get is when send activation codes:

ried to send a member the activation codes got this

Originally Posted by MrEyes (Post 1670808)

If you have applied the fix I mentioned earlier you can fix this by using the following exclusions:

However this mean that you have switched off one of the actual checks and people will be able to pass urls as querystrings. This being said there are alot of mods out there that use this sort of thing and not many hacks that can abuse it. Your call.

There are better solutions, but this would need the entire mod to be reworked.

Originally Posted by dtv100 (Post 1670904)

any way to make it that user group 6 is ignore by firewall ?

Originally Posted by MrEyes (Post 1670808)

If you have applied the fix I mentioned earlier you can fix this by using the following exclusions:

However this mean that you have switched off one of the actual checks and people will be able to pass urls as querystrings. This being said there are alot of mods out there that use this sort of thing and not many hacks that can abuse it. Your call.

There are better solutions, but this would need the entire mod to be reworked. For example the ability to set an exclusion at a page level. So you could exclude viewsubscription for misc.php but not payments.php, and http for redirector.php (vbAnonymizer mod)



This could probably also be fixed by exclusions

Originally Posted by hornstar1337 (Post 1670296)

This might have great potential. I will tag this for now.

Originally Posted by djbaxter (Post 1674317)

Uh-oh.

I just installed this. And I just receiveed the following email from the add-on:



Blocking Googlebot can't be good. I've disabled the add-on for now. Any suggestions?

Originally Posted by Alex LD (Post 1674343)

do you think this would work for 3.7.4? too I know its for 3.8

Originally Posted by djbaxter (Post 1674317)

Uh-oh.

I just installed this. And I just receiveed the following email from the add-on:



Blocking Googlebot can't be good. I've disabled the add-on for now. Any suggestions?

Originally Posted by invisiblea (Post 1674442)

What Mod is it?

Originally Posted by djbaxter (Post 1674494)

This one. vBFirewall 1.0.

Originally Posted by invisiblea (Post 1674618)

can you tell me all steps you used to generate that error?

Originally Posted by djbaxter (Post 1674866)

OK. I re-enabled this add-on. This time I received the following two emails:





So it appears there's a problem with this add-on: It's blocking spiders, which isn't something most of us want to do.

Disabled again.