[Menewsha]

Cool plugin, but there is a pretty serious oversight in this plugin which led to a ton of abuse recently.

The remote cache option states the following: "Duration in minutes that remote queries should be cached to reduce query traffic / lookup duration and load on the remote server"

However the code says this:

$sql = 'DELETE FROM '.TABLE_PREFIX.'glowhostspamomatic_remotecache WHERE `date` < DATE_SUB(NOW(), INTERVAL '.(int)$vbulletin->options['glowhostspamomatic_remote_cache'].' DAY); ';

So we were hit by a botnet (one new registration attempt every four seconds, not even exaggerating) and we were expecting that after an IP was reported, that we wouldn't see that IP registering again after the 30 minute cache timeout. This led to two issues:

1) The cache isn't cleared for the banned user immediately, meaning the bot could immediately reregister without SFS being checked for the new entry.

2) The cache was 30 days old, so the same IP would literally create thousands of accounts before the cache would clear and start reporting the abuse.

This also led to another observation of the code. The order of checks goes username, email, IP. However the order of checks (to take advantage of cache) should go IP, email, username. The code shouldn't even waste time querying for a bad username if it knows the IP is bad, so why put unnecessary strain on the SFS service by querying for username if the IP is bad?

So, as I said, great plugin, but it needs some changes to work properly on a high traffic site effectively.

Edit: I thought I'd mention how I changed the query. This should hopefully increase cache efficiency also:

$sql = 'DELETE FROM '.TABLE_PREFIX.'glowhostspamomatic_remotecache WHERE (`date` < DATE_SUB(NOW(), INTERVAL '.(int)$vbulletin->options['glowhostspamomatic_remote_cache'].' MINUTE) and is_spambot = 0) or (`date` < DATE_SUB(NOW(), INTERVAL '.(int)$vbulletin->options['glowhostspamomatic_remote_cache'].' DAY) and is_spambot = 1); ';

This would delete SFS negatives that are 30 minutes old, while letting SFS positives sit in the database cached for 30 days.