Integration with vBulletin - vB Bad Behavior

/**
* vB Bad Behavior is free software; you can redistribute it and/or modify it under
* the terms of the GNU Lesser General Public License as published by the Free
* Software Foundation; either version 3 of the License, or (at your option) any
* later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT ANY
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
* PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
*/

What is vB Bad Behavior?
This is an integration of the Bad Behavior software with vBulletin.

What is Bad Behavior?
Bad Behavior is a PHP-based solution for blocking link spam and the robots which deliver it. Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place. This keeps your site's load down, makes your site logs cleaner, and can help prevent denial of service conditions caused by spammers.

Visit http://bad-behavior.ioerror.us/ for more.

Features
For more information on the features of Bad Behavior (and subsequently this mod) please go to Bad Behavior's site:

http://bad-behavior.ioerror.us/documentation/benefits/

For features related to the mod itself, please take a look at the screenshots.

This mod should work with the entire 3.x series (well, beginning with 3.5), but it's only been tested on 3.8.x. I'm not sure if this works on vB 4.x yet, as I've not tested it - but if you try it out, let me know!

Installation
1. Extract the contents of the zip file.
2. Upload the contents of the `upload` folder to your forum root.
3. Enter your AdminCP and go to Plugins & Products > Manage Products > [Add/Import Product]
4. Import the product using the `product-vb_badbehavior.xml` file.
5. Configure the mod in AdminCP -> vBulletin Options -> vBulletin Options -> vB Bad Behavior Options

Upgrading

vB Bad Behavior
In many cases, all you'll need to do to upgrade is follow the installation instructions above.

The only difference, will be you'll need to allow the files to overwrite. Also, when re-importing the product file, you'll need to set "Allow Overwrite" to "Yes".

Bad Behavior
Bad Behavior's files are at `/includes/bad-behavior/`. If you wish to update manually go to:

http://bad-behavior.ioerror.us/download/

And download the latest development version. Extract the zip, and upload the contents of `bad-behavior` to `/includes/bad-behavior/` allowing the files to overwrite.

Versions
The current version of Bad Behavior this mod is using is: v2.2.14
The current version of Bad Behavior (development) is: v2.2.14

Changelog
Version 1.0.13, 04/23/2013

• Bad Behavior upgraded to 2.2.14

Version 1.0.12, 12/21/2012 -- Released: 02/05/2013

• Bad Behavior upgraded to 2.2.13
• Added some more ranges to whitelist.ini

Version 1.0.10, 09/09/2012

• Bad Behavior upgraded to 2.2.10

Version 1.0.9, 06/17/2012

• Bad Behavior upgraded to 2.2.7

Version 1.0.8, 06/12/2012

• Bad Behavior upgraded to 2.2.6
• New Setting: EU Cookie

Version 1.0.7, 05/04/2012

• Bad Behavior upgraded to 2.2.3
• Cron/Scheduled Task for automatic log pruning added.

Version 1.0.6, 01/04/2012

• Bad Behavior upgraded to 2.1.15

Version 1.0.5, 05/26/2011

• Added option for bypassing users/members.
• If the visitor is a user, and is in usergroup 5, 6, or 7 (admin/mod/super mod) - Bad Behavior is bypassed.
• Modified bad-behavior core to check for Google Web Preview
  • file edited: /includes/bad-behavior/core.inc.php
• Added a link beside the IP address in the log for WhoIs.

Version 1.0.4, 04/28/2011

• Bad Behavior upgraded to 2.1.13 (fixes search engine block issues)
• Added Paypal/Paypal IPN IP address to the whitelist.
• Added payment gateway file names to the whitelist.

Version 1.0.3, 04/21/2011

• Fix #1: Pruning log doesn't work.
• Fix #3: POST more than two days after GET (added support for BB's javascript)
• Fix #5: Cannot modify header information error (suppressed error in BB's function)
• Implemented #6: Filter per key (new admincp option to list keys not to be shown in log)
• Implemented #9: Show link to member profile (if userid is found in headers, link to profile)

Version 1.0.2, 04/10/2011

• Updated /includes/functions_vb_badbehavior.php to:
  • disable Reverse Proxy if Reverse Proxy Addresses are empty
  • distinguish SQL queries using "SET", for example: SET @@session.wait_timeout = 90 - which is used by BB
  • set "offsite_forms" to false by default, as it's not really needed in vB IMHO, and it can cause problems with certain setups
  • cleaned up the bb2_read_settings() function and fixed a typo in one of the vbulletin options calls
• Updated /includes/whitelist.ini to include the following GOOGLE ranges:
  • 74.125.0.0/16
  • 216.239.32.0/19
  • 209.85.128.0/17
  • 66.102.0.0/20
• Updated /admincp/vb_badbehavior.php
  • Log pruning was pruning all logs, despite what was entered for number of days

Version 1.0.1, 04/06/2011

• Bad Behavior upgraded to 2.1.12
• Changed files:
  • /includes/bad-behavior/core.inc.php
  • /includes/bad-behavior/searchengine.inc.php
• "Verbose" admin option now set to "No" by default.

Version 1.0.0, 04/05/2011

• Initial release.

Screenshots
Screenshots can now be seen at: http://www.secondversion.com/images/vb/vb_badbehavior/

I was running out of room for attachments here on vB.org


Development

https://github.com/ericsizemore/vb_b...ree/master/vb3


Only those who "Mark As Installed" will receive support for this modification.

[Alfa1]

Thanks for the update!

Originally Posted by Eric

#3 may need some time to work itself out, since it's based on cookies as well.

My memberbase is 90.000 large. Some of these may not visit again until years from now and cookies may remain on a computer for a few years, so this would take a very long time to fade out. If it would fade out.

Originally Posted by Eric

Not much I can do about #4

Could you explain what the issue is? Do you have any idea why so many valid users have 'accept' missing in the header? Are they using some kind of inprivate browsing?

Could you add the key filter to the top of the log view page, so that the log can be filtered while browsing the log?

I posted this Article on vbulletin.com:
Bulletproof spam & scraper protection

[Simon Lloyd]

I have had this mod installed now for 5 days, it has prevented many thousands of attempts to access images....etc and in turn has saved me around 80GB in bandwidth already compared to the same period last month -so a great big THANKS to Eric!

just about to upgrade to the latest version

[Lee G]

28k and still counting
Nice smooth upgrade
Now its time to integrate my old block list with the new version and that number should go up at a fair rate

[Eric]

Originally Posted by Alfa1

Thanks for the update!

My memberbase is 90.000 large. Some of these may not visit again until years from now and cookies may remain on a computer for a few years, so this would take a very long time to fade out. If it would fade out.

Could you explain what the issue is? Do you have any idea why so many valid users have 'accept' missing in the header? Are they using some kind of inprivate browsing?

Could you add the key filter to the top of the log view page, so that the log can be filtered while browsing the log?

I posted this Article on vbulletin.com:
Bulletproof spam & scraper protection

Alfa1, I do apologize, but I have no idea right now what the issue is with the Accept header. There are a few possibilities, however, such as if the user is using a proxy/VPN... or if they are running the browser in "private" mode - there is also some PC software that could cause the problem. I'm going to talk with Michael (error10) about this, and see if he has any ideas.

As far as adding the key filter to the log page, should be possible. And great article

Originally Posted by Simon Lloyd

I have had this mod installed now for 5 days, it has prevented many thousands of attempts to access images....etc and in turn has saved me around 80GB in bandwidth already compared to the same period last month -so a great big THANKS to Eric!

just about to upgrade to the latest version

Originally Posted by Lee G

28k and still counting
Nice smooth upgrade
Now its time to integrate my old block list with the new version and that number should go up at a fair rate

Nice! And no problem, I'm glad this mod is so useful to some of you.

[Simon Lloyd]

Eric, on your new release i am getting some blocked which show UserId: as blank and the exact same IP but a slightly different GET does not display UserId:

Is there a possibilty fix that, they're obviously not users but must be delivering a call that is mimicking a user but there's no confirmed login...etc, i might be talking twaddle as i don't understand the GET and all the garb that follows it but i hope you get the gist

[Lee G]

Same problem being experienced as Simon above

[Eric]

Originally Posted by Lee G

Same problem being experienced as Simon above

Originally Posted by Simon Lloyd

Eric, on your new release i am getting some blocked which show UserId: as blank and the exact same IP but a slightly different GET does not display UserId:

Is there a possibilty fix that, they're obviously not users but must be delivering a call that is mimicking a user but there's no confirmed login...etc, i might be talking twaddle as i don't understand the GET and all the garb that follows it but i hope you get the gist

Hmm. Could you try something for me? Edit `/includes/functions_vb_badbehavior.php` and replace the `bb2_log_userid` function with:

PHP Code:

// Determines if vB Bad Behavior has blocked a user request
// Checks to see of userid is present in the Cookie header
function bb2_log_userid($headers)
{
    if (!empty($headers))
    {
        $_tmp = explode("\n", $headers);
        $_tmp = implode('', array_filter($_tmp, '__walker'));
        $_tmp = str_replace(';', '&', $_tmp);

        if (empty($_tmp))
        {
            return false;
        }
        parse_str($_tmp);

        $userid = COOKIE_PREFIX . 'userid';

        return iif($$userid > 0, $$userid, false);
    }
    return false;
} 


[Simon Lloyd]

Ok just done (07:07 GMT) will report back later today as i get many thousands a day getting caught in this

EDIT: Just cleared all logs too!

[Simon Lloyd]

Ok here's some results, this one was captured, didn't show UserId and isn't registered or unconfirmed:
HEADER
POST /forumz/login.php?do=login HTTP/1.0
Accept: */*
Cookie: tccsessionhash=e575197d38d5a7c06fe82415e7688d00; tcclastvisit=1303620326; tcclastactivity=0; vbet_sessionUsed=1
Host: www.thecodecage.com
Pragma: no-cache
Proxy-Connection: Keep-Alive
Referer: http://www.thecodecage.com/register.html?agreed=true
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
ENTITY
vb_login_username: elderatot
cookieuser: 1
vb_login_password: 18gcAEp796
submit: Log in
s:
securitytoken: guest
do: login
vb_login_md5password: 8fb830d941xxxxxxxxbfe29fcc8
vb_login_md5password_utf: 8fb830d9412xxxxxxxxbfe29fcc8
ajax: 0
KEY
2b021b1f

Just in summary, i went through 1,000 (no really i did ) entries and none of them including the one above showed UserId either filled in or blank.

Hope that helps.

[error10]

Hey all,

For some reason I wasn't getting notifications despite being subscribed to the thread. I'm going back through the messages to see what, if anything, needs to be added or changed in the Bad Behavior core. I'll push an update out as soon as I'm done.