Where are the banned IP addresses stored?

[apleschu]

I have extended the spambot blocker a little bit so that it creates a log of who and when was blocked and from what IP address they came. Today I had the idea that it might be a good idea to automatically block the IP addresses they are coming from as well. That way they can try it once and then they are done.

Unfortunately, being new to vB programming I was unable to find where the banned IP addresses are stored and how to manipulate that list, but the latter is a question on where they are stored first.

Can anybody point me into the direction where I can find that ?

[kh99]

They are stored as the value of the setting, so they are in the setting table. But the settings are combined and put in the datastore, so after you update the setting table, you want to call build_options() which is in includes/adminfunctions.php.

So a string of the current banned ips will be in $vbulletin->options['banip'], and you can see how that's used in function verify_ip_ban(), which is in includes/functions.php, and once you add to the string it you'd want to do something like:

require_once(DIR.'/includes/adminfunctions.php');
$vbulletin->db->query_write("UPDATE ".TABLE_PREFIX."setting SET value = '".$vbulletin->db->escape_string($value)."' WHERE varname='banip' ");
build_options();

Edit: and now that I think about it, that could be a lot of db work to be doing if you have a lot of attempts. I don't know, maybe not. But one alternative would be to just update the datastore row directly by using a REPLACE in the query. But it's a serialize array of all the options so you'd have to get it right. Another way might be to implement your own ip ban using hook global_state_check, which is called right after verify_ip_ban(). You could probably copy the verify_ip_ban function and modify it.

[apleschu]

Thank you for the pointer, Much appreciated. That gives me something to start looking.

--------------- Added [DATE]1426622022[/DATE] at [TIME]1426622022[/TIME] ---------------

AND ... it works. Now, if those suckers show up once their IP will be banned and instead of creating problems over and over and letting them try over and over the first time they fail their IP is gone for good.

Next thing will be to make the test for the banned IP faster. Currently that is a linear search, which for only a few IP adresses is OK, but once those become hundreds something better needs to be done.

Currently I am thinking of keeping the list of banned IPs as a sorted address then then there are only 10 comparisons for 1024 entries.