vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)
-   -   Reload Flood Control (https://vborg.vbsupport.ru/showthread.php?t=43228)

Zzed 09-05-2002 10:00 PM
Reload Flood Control
 
This is a fairly simple hack. I implemented it a couple days ago. And realized
that it had also been requested by scotty back in June.

https://vborg.vbsupport.ru/showthrea...threadid=40297

This hack limits the number of http requests to 1 request per IP address
per second. It works for both registered users as well as guests. If a users
hits the refresh button more than once per second he will be taken to the
error screen. The hack actually terminates the loading process of the page
in the early stages and prevents the server load from going up. I have
tried the refresh flood with and without this hack. And without the hack
I got the server load to go from 0.7 to about 25 with about 30 people logged
on. With the hack in place, the same refresh flood caused the load to go as high
as 1.2.

This hack requires you to create a new template. And it modifies 2 source
files: global.php and showthread.php.

In admin CP add the following template: error_floodreload
Add the following text to the template:
Code:
Sorry! The administrator has specified that users can only make one http request every 1 second.
In global.php
Look for the following code:
PHP Code:
if (!$servertoobusy) {
  require('./admin/sessions.php');
} else {
  $session = array();
  $bbuserinfo = array();
} 
Add this code directly above it:
PHP Code:
// Flood control for abusive relaods...
$user_ip=$DB_site->query_first("select host, location, lastactivity from session where host = '".addslashes($REMOTE_ADDR)."' order by lastactivity desc limit 1;");
if($REMOTE_ADDR == $user_ip[host]) {
  global $bbtitle,$logincode,$url,$scriptpath,$bbuserinfo,$session;
  $time_now = time();
  if($time_now == $user_ip[lastactivity]) {
    $DB_site->query("update session set lastactivity='$time_now' where host='".addslashes($REMOTE_ADDR)."' and lastactivity='$user_ip[lastactivity]';");
    $style=$DB_site->query_first("select * from style where userselect = 1;");
    $templatesetid = $style[templatesetid];
    $styleid = $style[styleid];
    $replacementsetid = $style[replacementsetid];
    eval("standarderror(\"".gettemplate("error_floodreload")."\");");
    exit;
  }
} 
In showthread.php
Look for the following code:
PHP Code:
// goto last post
if ($goto=="lastpost") { 
Replace it with
PHP Code:
// goto last post
if ($goto=="lastpost") {

// Flood control for abusive relaods...
  sleep(1); 
In showthread.php
Look for:
PHP Code:
// goto newest post
if ($goto=="newpost") { 
Replace it with:
PHP Code:
// goto newest post
if ($goto=="newpost") {

// Flood control for abusive relaods...
  sleep(1); 
The reason for the 1 second sleeps is to prevent the error screen from popping up when
the user clicks on the goto newest or goto last post arrows in the forum display.
Those 2 calls end up making a second recursive call to showthread.php which ends up
being within the same 1 second interval of the click itself. This way you are fooling
the flood control so that it wont catch the back to back requests.

Logician 09-06-2002 09:20 AM
it's a very good idea and a must have hack especially for people having bandwidth problems. IMO it also fixes the gap someone could exploit by sending too many page requests for a long time and thus making your server busy all the times. It wouldnt be a problem for manual sending but a malicious hacker could always code a script to make it automatically and increase your server load dramatically. So great fix..

One minor issue though: it would prevent users open a few pages at the same time when they come to the site. For example when they make a search, they cant anymore open a few threads at the same time by clicking "Open in new browser windows" link. (which I do a lot!). Of course this is not related to you it's the nature of the hack but maybe setting the second to 0.5 instead of 1 may be a little help for these users...

Zzed 09-06-2002 09:24 AM
Thank you for your kind words. :)

We do suffer from high loads on our server.

You can actually load multiple pages. I do that all the time. I am willing to bet you money that opening the subsequent windows will take longer than a one second interval. ;)

The Ghost 09-06-2002 12:30 PM
Very Great Hack, I have a lot of peoples which refreshs only to kill my board.......

thx

MarkB 09-06-2002 12:32 PM
Has it affected bandwidth at all?

The Ghost 09-06-2002 01:22 PM
Well, I've installed your great Hack, but if I now press the "F5" Key (Refresh) ever and ever I don't see the Antiflood Message....

I've Tryed it very often......

Zzed 09-06-2002 02:27 PM
MarkB, it will prevent the server load from going up.

The Ghost, can you double check your installation steps and make sure you haven't left anything out?

Neo 09-06-2002 05:22 PM
Nice.

The Ghost 09-06-2002 11:35 PM
Hi,

I checked it all again and again step by step, but I think it doesn't work for me :(

Zzed 09-07-2002 09:24 AM
Can you Email me a copy of your global.php?

edwink@seebeyond.com

rapsearch 09-07-2002 02:42 PM
added it but when i try it out... i don't see the text message??.. the screen pops up.. but not with the line from the template??

I did add it....

Rapdis 09-07-2002 03:50 PM
i added it all... i dont see it either.... please advise, by the way, im using 12 gb and only 450 members, i got a big problem sumwhere and need help.

Zzed 09-07-2002 09:44 PM
Ok, I updated the instructions and the attachment.

I needed to obtain the proper templateset, replacementset, and style id's in order for the error screen to load properly for those of you who have been having trouble with it.

I replaced
PHP Code:
    $templatesetid = 1; 
with
PHP Code:

    $style=$DB_site->query_first("select * from style where userselect = 1;");
    $templatesetid = $style[templatesetid];
    $styleid = $style[styleid];
    $replacementsetid = $style[replacementsetid]; 
I apologize for your inconvenience. :(

rapsearch 09-11-2002 11:12 AM
did what you suggested but still got the same screen??

see attachment.....

GeorgeofCS 11-14-2002 10:22 PM
Is there any way to make this hack affect just non registered members?

Remi 11-15-2002 12:18 AM
Does this hack work if you block cookies, and if not, how can I force users to enable cookies or they can't brows my board :D.

Thanks in advance

X-Fan 11-15-2002 11:25 AM
Hmmm, I've got a similar problem to Ghost. I installed this hack, following the steps to the letter, loaded a thread, then pressed F5 repeatedly (in fact, I sat there with my finger on the button for about 10 seconds) and the page still loaded for me - no error message at all.

Boofo 03-21-2003 07:11 AM
Quote:
09-06-02 at 04:20 AM Logician said this in Post #2
it's a very good idea and a must have hack especially for people having bandwidth problems. IMO it also fixes the gap someone could exploit by sending too many page requests for a long time and thus making your server busy all the times. It wouldnt be a problem for manual sending but a malicious hacker could always code a script to make it automatically and increase your server load dramatically. So great fix..

One minor issue though: it would prevent users open a few pages at the same time when they come to the site. For example when they make a search, they cant anymore open a few threads at the same time by clicking "Open in new browser windows" link. (which I do a lot!). Of course this is not related to you it's the nature of the hack but maybe setting the second to 0.5 instead of 1 may be a little help for these users...
What would we need to change in this code for the 0.5 setting?

Zzed 03-21-2003 07:53 AM
Since the time of last activity in the session table has a granularity of 1 second, there is not much to do to increase the precision of the time.

Boofo 03-21-2003 08:05 AM
How was Sinan (Logician) talking about doing it?

Stickers 03-31-2007 07:12 PM
Hi,

Can you maybe make this also for 3.6.5?

Best regards
Stickers

Zachery 03-31-2007 07:22 PM
Considering Zzed hasnt posted in 2-3 years maybe requesting it instead of bumping a old thread might have been a good idea ;)

Stickers 04-02-2007 12:25 PM
Good point Zachery :D


All times are GMT. The time now is 10:33 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01137 seconds
  • Memory Usage 1,784KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (8)bbcode_php_printable
  • (1)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (23)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete