Simple Machines Community Forum

Link to Mod (https://custom.simplemachines.org/mods/index.php?mod=2502)

---

---

Written by:                   butchs (http://www.simplemachines.org/community/index.php?action=profile;u=77887)
Current BB version:      2.2.20
Compatibility:               SMF 1.1.21 & SMF 2.0.15
Supported languages: english, spanish_es, spanish_es-utf8, spanish_latin, italian, italian_utf8
Translations:                Translations are accepted

Donations accepted to help support this mod (please specify the name of the mod when donating).
(https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=UJTMMF8FKGLZ6&lc=US&item_name=butchs%2f%20continued%20updates&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted)

---

SMF integration for Bad Behavior / Bad Behaviour (http://bad-behavior.ioerror.us/).  Which is a PHP-based solution for blocking link spam and the robots which deliver it.

The mod includes plenty information in the help icons.  Just click on the icons.

Standard option information is located at the core bad-behavior (http://bad-behavior.ioerror.us/) site.

This is the first implementation of Bad Behavior / Bad Behaviour for one of the major forum platforms.  This port has more features than the Core and most Ports on the internet.  It has taken many hours of hard work to create this mod.  I sure hope that the fruits of my labor reduces spammery on your SMF forum!

Sincerely,
butchs (http://www.simplemachines.org/community/index.php?action=profile;u=77887)

---

To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.

   
• Windows use FireFox with the [nofollow]"Modify Headers" (https://addons.mozilla.org/en-US/firefox/addon/967)[/nofollow] add-on.
• Macintosh, [nofollow]"enable the Develop menu" (http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm)[/nofollow] in Safari.

If you look at the page source (just below the title) you will see the speed of this mod at work:  <!-- Bad Behavior 2.2.17 run time: 3.025 ms -->

---

Bad Behavior / Bad Behaviour icons for your front page:
Show everyone that you have taken the care to protect your forum from spammery:


<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.yoursite.com/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

Please copy the above master image to your site and adjust only the image link.  Let the bad bots come to Bad Behavior.

---

How Bad Behavior Works:
Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place. This keeps your sites load down, makes your site logs cleaner, and can help prevent denial of service conditions caused by spammers.

Bad Behavior manages to block nearly all link spam without ever looking at the spam. While it might be useful to do so, for performance reasons, Bad Behavior does not analyze received spam. Ive found that this way lies madness; spammers are constantly buying new domain names, so its possible to miss a lot of spam by looking at it.

Instead, Bad Behavior pioneered an HTTP fingerprinting approach. Instead of looking at the spam, we look at the spammer. Bad Behavior analyzes the HTTP headers, IP address, and other metadata regarding the request to determine if it is spammy or malicious. This approach has proved, as one user said, shockingly effective. After all, spammers write their bots on the cheap, and have little incentive to code very well. If they could code very well, they probably wouldnt be spammers.

When Bad Behavior looks at a request, it determines if the request matches a profile of known malicious or spammy activity, and falls outside the bounds of a normal human browsing the web. If so, the request is blocked. But a way out is provided for any human beings with unusual configurations or viruses/Trojans on their computer who may be blocked.

From the start, Bad Behavior has had two overriding design requirements. The first is that it must be fast. Users will get annoyed by waiting around for their traffic to be screened for spammery.  Bad Behaviors run time, which is typically measured in milliseconds, and can be cut to hundreds of microseconds for very high traffic sites.

The second requirement is that it must block as few legitimate users as possible, and when one is blocked, they must be able to unblock themselves through an action simple and fast enough that they can simply hit the browsers reload button once theyve completed the action.

---

INSTALLATION:

Please look at all the preview images on the mod (http://custom.simplemachines.org/mods/index.php?mod=2502) page.

Adjust settings before you enable the mod.
(Mod will disable it's self when uninstalled)

Check all the options that are "Recommended" in "Bad Behavior Admin/ SETTINGS".

Whitelist all your regular members.  Read "WHITELIST MEMBERS HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306)" for details.

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL httpBL - - - - - - - - - - - - - - - - - - - - - - -
The core of the mod protects your site even if httpBL is not enabled.  It is recommended to increase protection by adding httpBL.

httpBL procedure:
Register your site at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#b).
Get the access key at ProjectHoneyPot (http://www.projecthoneypot.org/faq.php#g).
Add an OPTIONAL honey pot script for your site.
Copy the OPTIONAL honey pot  (http://www.projecthoneypot.org/manage_honey_pots.php) script to your site (the same location as the SMF folder).
Activate the OPTIONAL honey pot (http://%20www.projecthoneypot.org/manage_honey_pots.php) script and confirm it is active.

Copy over the HoneyPot information in the "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist" area:
•   http:BL Access Key - Access Keys are 12-alpha characters (no numbers). They are lower-case. You should copy the Access Key exactly as it appears at the Project Honey Pot network (http://www.projecthoneypot.org/httpbl_configure.php).
•   Minimum Threat Level - 25
•   Maximum Age of Data - 30
•   Honeypot Link - The link to the OPTIONAL honey pot Script Location or a QuickLink (http://www.projecthoneypot.org/manage_quicklink.php).
•   Honeypot Link word - A word you make up.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL CloudFlare - - - - - - - - - - - - - - - - - - - - - - -
If you are successfully using CloudFlare:  Enter "Cf-Connecting-Ip" in "IP call to Reverse Proxy" and check "Enable Reverse Proxy".

THIS MOD ASSUMES THAT YOU MADE MODIFICATIONS TO SMF SUCH THAT CLOUDFLARE IS OPERATIONAL ON YOUR SITE.  See the Cloudflare mod here (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - OPTIONAL Admin Choice - - - - - - - - - - - - - - - - - - - - - - -
Administrators are automatically whitelisted by the mod.  If you are paranoid, you can make the these changes.

Enter your personal admin IP address or CIDR range "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address".  For more information read "ADVANCED WHITELIST HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023)".
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Check "Enable Bad Behavior".

---

FAQs:
•   WHITELIST MEMBERS HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3403306#msg3403306)
•   ADVANCED WHITELIST HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023)
•   USING OpenID HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3152400;topicseen#msg3152400)
•   USING PAYPAL HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3152326;topicseen#msg3152326)
•   SUSPICIOUS BBC TAG HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3122889;topicseen#msg3122889) and a follow-up (http://www.simplemachines.org/community/index.php?topic=375980.msg3873456#msg3873456) - Only for SMF 2.0 Gold.
•   UPGRADING FROM AN OLDER VERSION HELP (http://www.simplemachines.org/community/index.php?topic=375980.msg3478178#msg3478178).
•   MANY BOT HITS A WEEK (http://www.simplemachines.org/community/index.php?topic=375980.msg3565493#msg3565493)
•   RANDOM CHARACTERS ABOVE FORUM HEADER (http://www.simplemachines.org/community/index.php?topic=375980.msg3499684;topicseen#msg3499684)

---

Version History:
1.0.0 --  March 23, 2010
o   -  Initial release for SMF 2.0 RC2 & RC3 default theme only. Compatible with BB 2.1.2.
1.1.0 --  August 4, 2010
o   -  New compatibility with BB 2.1.4:  Added CloudFlare compatibility and one nasty anti-Forum program to the ban list.  This version requires updates of both part 1 and part 2.
1.1.1 --  August 7, 2010
o   -  An error was discovered in the "whitelist.ini" file.  Anyone who downloaded "bad_behavior_install_pt1of2.zip" between August 4, 2010 and August 7, 2010, who used the "whitelist.ini" file from "bad_behavior_install_pt1of2.zip" please download this new "bad_behavior_install_pt1of2.zip" version.
1.2.0 -- August 8, 2010
o   -  "whitelist.ini" file has been re-written.  It is suggested that all users review and modify this file.  New compatibility with BB 2.1.5:  Fixed CloudFlare compatibility. MSN bot and ereg errors fixed in core.  All users should upgrade your "whitelist.ini" file.  This version requires updates of both part 1 and part 2.  Backup your "whitelist.ini" before upgrading.
1.3.0 --  November 6, 2010
o   -   Now compatible with SMF 2.0 RC4.  Improved roundtripdns and cache.  Added yahoo check (will temporarily reports error as msnbot - waiting for BB to catch up), auto purge of BB cache.  Removed cloudflare check due to DNS issues at cloudflare.  Fixed RC4 bugs in admin area that prevented saving and displaying of detailed reports.  Mod now has its own cache, it no longer requires SMF caching to be enabled.
1.4.0 -- February 20, 2011
o  - Mod Rewrite. Big thanks to BigGuy at SMFHelper (http://www.smfhelper.info/) for testing.  Mod is compatible with SMF 1.1.x, SMF 1.1.x Bugs fixed, detected by ac19189 & packman.  No changes for 2.0 RCx, Spanish Translation(s) - thanks xaquin (http://www.simplemachines.org/community/index.php?action=profile;u=246023), Added Project Honeypot to admin panel, blank UA can  be blocked.  Spanish language files now auto load, Changes for mod_security compatibility - thanks Darkness*, Update Bad Behavior core to 2.1.12, Fix for Undefined index: id_group & description of error link (thanks Dmytro) in 1.1.x.  - Bad Behavior core to 2.1.13
1.5.0 - June 05, 2011
o 1.5.0  - Added random Google safe honeypot, httpBL suspicious visitors are now logged.
o 1.5.1 - June 18, 2011 - badbehavior_httpblnote error in 1.1.x(djkimmel), 'http_headers' can't have a default value 2.0 & 1.1x(evanoliver), updated core.inc.php & blackhole.inc.php.
o 1.5.2 - July 10, 2011 - Can't have a default valueFile (evanoliver), added httpBL on/off line & API key check, improved whitelist.
o 1.5.3 - July 25, 2011 - Fixed rare error with Cloudflare Server, added suspicious BBC for SMF 2.0 ONLY, limited front page honeypots
o 1.5.4 - August 4, 2011 - Fixed integration bug thanks mediaworksmt, Completed http:BL & BB installation validation, Bad Behavior 2.1.14 update
o 1.5.5 - September 19, 2011 - Upgrade to 2.0.1, File-access disabled fixed for some servers (jbw-creA2s), improved map trap
o 1.5.6 - October 21, 2011 - 1.1.x db errors fix, updated core to 2.1.15
o 1.5.7 - December 16, 2011 - Anti-bot security fixes, all users should upgrade to this version.
o 1.5.8 - February 4, 2012 - Updated core to 2.2.1.
o 1.5.9 - March 11, 2012 - Revamped reverse proxy, Upgrade to 2.2.2.
o 1.5.10 - May 27, 2012 - Added Lazybones badbehavior_bbc.gif, Upgrade to 2.2.6, improved reverse proxy address, moved whitelist to admin, updated Spanish by xaquin
o 1.5.11 - June 24, 2012 - Upgrade to 2.2.7, text corrections a bug fix
o 1.5.12 - September 3, 2012 - Upgrade to 2.2.9
o 1.5.13- September 3, 2012 - Added IP sort & username for SMF 2.x only, Upgrade to 2.2.11
o 1.5.14 - December 9, 2012 - Improved TESTING, Removed badbehavior_log_table modsetting, Upgrade to 2.2.12
o 1.5.15 - December 13, 2012 - Upgrade to 2.2.13
o 1.5.16 - May 5, 2013 - revised mysql, honeypot link height thanks RustyBarnacle, Upgrade to 2.2.14, updated httpbl search engines
o 1.5.17 - June 30, 2013 - SMF 1.1.X ONLY -  fixed undefined variable- thanks chrishicks
o 1.5.18 - January 25, 2014 - Upgrade to 2.2.15, Search Engine DNS updated, minor changes installDB
o 1.5.19 - December 27, 2015 - Upgrade to 2.2.17, changed SPAM traps, improved cache
o 1.5.20 - December 31, 2017 - Upgrade to 2.2.20, fixed $bballotted error, added italian, updated readme files
o 1.5.21 - February 5, 2018 - Removed carriage return in BadBehavior-SMF

---

---

By downloading and/or using this MOD you agree to adhere to the following conditions for all versions of the Bad Behavior mod:

   
• The license for the mod is not the same as the license for the core.
• The Mod Author/Creator retains all rights to the code for the mod portion.
• The Mod Author/Creator is not responsible for any incompatibilities of this mod with your forum.
• You are FREE to use and customize this MOD on your Forum(s) in any way you see fit, however, in no way can the Author/Creator of this MOD be held responsible under any circumstances.
• Commercial resale of this mod is prohibited without express written permission from the Mod Author/Creator.
• You are FREE to redistribute this MOD in its original, released state ONLY!
• Conversion, transfer or porting any portion of the mod Authors Creative Work, ideas, procedures and process to any SMF fork without the Authors explicit written permission is strictly prohibited.
• These terms can be changed or appended at any time by the Mod Author/Creator without any prior notice.

---

---

mod bad-behavior

Antes de instalar este mod, establezca su zona horaria local en el archivo .htaccess o php.ini.

Como hacerlo en .htaccess:
#Establecer zona horaria
SetEnv TZ Europe/Madrid

Una lista de ubicaciones para que pueda elegir:
http://www.php.net/manual/en/timezones.php (http://www.php.net/manual/en/timezones.php)

---

En la instalaci√≥n en SMF 2.0x o posterior, SMF puede preguntarle si desea "Restaurar permisos de archivo" para  "banned.inc.php"..  No realice ning√∫n cambio!

---

Para probar:
Para asegurarse que Bad Behavior funciona correctamente puede agregar la cadena "Bad Behavior Test" al agente de usuario (User Agent) de una petición HTTP realizada por alguien que no conste en la lista de autorizados y no sea el administrador.

• Windows use FireFox con el complemento [nofollow]"Modify Headers" (https://addons.mozilla.org/en-US/firefox/addon/967)[/nofollow]
• Macintosh, [nofollow]"Activar men√∫ Develop" (http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm)[/nofollow] en Safari.

En el código fuente de la página (justo después del título) se puede ver la velocidad de trabajo de este mod:
<!-- Bad Behavior 2.2.17 run time: 3.025 ms -->

---

---

bad-behavior mod

Prima di installare la Mod assicurati che la tua Timezone locale sia impostata nel file .htaccess o php.ini.

Come configurarla nel file .htaccess:
#Set the timezone
SetEnv TZ America/New_York

Qui una lista di valori tra cui poter scegliere:
http://www.php.net/manual/en/timezones.php (http://www.php.net/manual/en/timezones.php)

---

Durante l'installazione di SMF 2.0x e/o successivamente, SMF potrebbe chiedere di During installation of SMF 2.0x and or at a later date, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!

---

Per verificare il funzionamento:
Per assicurarsi che Bad Behavior funzioni correttamente puoi aggiungere la stringa "Bad Behavior test" allo User Agent (UA) di una richiesta HTTP proveniente da un utente che non è nella Whitelist e non è l'Amministratore.

• Windows usa FireFox con l'addo-on [nofollow]"Modify Headers" (https://addons.mozilla.org/en-US/firefox/addon/967)[/nofollow].
• Macintosh, [nofollow]"enable the Develop menu" (http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm)[/nofollow] in Safari.

Se guardi il sorgente della pagina (subito sotto al titolo) potrai vedere la velocità di questa Mod:  <!-- Bad Behavior 2.2.17 run time: 3.025 ms -->

finally it's approved :) good job!

Thank you.   It was the easiest mod approval I had to date.  I must be improving.   :D

I noticed that many people are downloading just the mod.  Please note that this mod is a 2 part mod.  Yea it is unusual but that is what we need to do.  You first need to run the install then the mod.  Otherwise it will not work.  See the first post for more details.
:o

aaargh, yes I forgot to ping you about this. any particular reason why you didn't pack all stuff into one file, just out of curiosity? I have a feeling that most feedback you will be getting will be because somebody didn't read mod's info... ;)

I prefer to keep them apart for the following reasons:

• The BB core author "Michael Hampton" has approved that I can write the mod as long as he is only responsible for the core (not the mod).  So I broke them apart.
• I do not want to update the mod every time the core changes unless I have to.   If I packaged them together you will not be able to update until I had a chance to make a new package and will not be able to do it quick enough for most people here.
• You can quickly update the BB portion simply by uninstalling the mod, updating the key files in FTP and reinstalling the mod.

For more details please read the installation and update portions of the readme and the SMF readme.

I'm just saying... ;)

did you think about automatic download of the core files from within your mod? this way you don't have to distribute two files, people won't scream at you, and it's an easy way to keep the core files up to date

I know but, Dude, I spent 7 months on this mod.  My insanity goes so far.   I have no idea how to do that, if it was possible I probably could find a way but, right now I plan to take a break form coding.  O:)

I tried to install the core then update it as one package.  It worked fine for the install but failed when I tried to uninstall it.  It was a nasty crash that caused reinstallation of SMF on the test server.  Two files were better.  People should be able to install two mods.   :P


edit:  The more I think about it a download will most likley have the same fate as a single mod that edits files (same as above).    ???

Ok today we have over 6:1 download ratio of the mod vs install package.  Since it is an international site, I can only assume that many people downloading do not read the text or do not read English that well.  So I renamed the zip files to:

• bad_behavior_install_pt1of2.zip
• Bad_Behavior_mod_pt2of2.zip.

This should help improve things.

No changes made to the actual code.

Thank you for this Mod, I will be trying it out today.  I will make sure to install only the 1st part  O:)

Please let me know what you think?

By the way, though not recommended by all, I prefer to use strict mode.  It gets rid of those spammers hiding behind proxies.
8)

Quote from: butchs on April 16, 2010, 09:50:09 AM
Please let me know what you think?

By the way, though not recommended by all, I prefer to use strict mode.  It gets rid of those spammers hiding behind proxies.
8)

I will do that.  I don't know how much it will work right away.  I've only got one person signed up this week.  :-\

I doubt you will see much until you get more members.  My board has a medium-low visitor rate.  I was getting over 150 visitors a day when I started using the mod.  the first week Bad Behavior rejected 180 bad bots, the next week it was 80, then it slowed down to around 40 per week.

One heavily used web pages I have seen numbers from 1,000 - 3,000 rejected bad bots per week.
8)

Been testing this puppy for a few days on a 2.0 RC3 test site.  Now, after checking all the blocked IPs there is just one thing to say.. It works GREAT!

The install, although very simple, was at first a bit confusing. But reading ALL of the instructions helped.

One question,
How does this work for an admin or user with a dynamic IP?  Just curious. :)

Logged in admin users are skipped and are not checked.

I recommend that you put your IP in the whitelist just to be safe.  You can enter the IP range too.  I do not think that dynamic IP's will have a issue but if they do then they will need to enter the IP range of the host.

It is more important to review the whitelist and make sure that IP and URL of the forum is covered assuming that you have a non standard directory system.  ie.  "forum/index.php" instead of the standard "smf/index.php".
8)

I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.

How does the email work on the ERROR 403 message? Meaning I really dont' want to give out my email address so I can go from a web spammer to a victim of email spam

Quote from: HiramAbif on April 21, 2010, 05:15:33 PM
I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.

The mod does not check the number of posts it checks to see if the bot is bad.  If the dude is a real spammer chances are he will not be able to even get on your board.  But if he is a normal person playing games then you will need to use other measures.

Quote from: kizer on April 21, 2010, 06:37:58 PM
How does the email work on the ERROR 403 message? Meaning I really dont' want to give out my email address so I can go from a web spammer to a victim of email spam

The mod does not give out your email as a normal email.  If your email is [email protected] it shows admin at yoursite.com.  A human/ spammer will have to correct and type it in order to be able to send you a message.  So the chances are low that you will get spammed.

This is included so that regular users can contact you for access.  For example, someone you know logs in and gets ERROR 403.  They can then use this error to send you a message and get placed on the whitelsit by you.  If you did not give them a method to contact you, they will never be able to log in.

The email listed is from the "Webmaster Email Address" listed in "admin -> server settings -> general -> Webmaster Email Address".  It is not recommended but, if you do not want your email address showing up leave the above setting blank.

Further clarification on my last post (It was late and I was tired).

Attached is a copy of what the spammer will see when they are caught.

If the spammer clicks on [nofollow] "admin at eastcoastrollingthunder.com" [/nofollow] then they will record  [nofollow] "admin at eastcoastrollingthunder.com" [/nofollow].  Which will not send an email to your site.

But if one of your members click on it their email program will pop up and they will have to fix the address before it the message is sent.

Whatever you do, do not use your personal email address as the "Webmaster Email Address".  Besides being a modified return address in ERROR 403 the "Webmaster Email Address" is used to report forum errors and as a return email address for all the Newsletters that you send.  If a spammer is a member they can harvest your email address.  Instead use an email address specifically for your forum that has some sort of spam filter installed or run it through a email forwarding service.  Most people use one of the free address provided by the hosting company for the forum admin email address.  In many cases, the hosting company offers a configurable spam filtering system that you can use before you forward the message to your real email address.   Then use the forwarding system provided by their hosting company to forward the message to a real email address.  I do the same thing but I forward my admin to a email forwarding service [nofollow]http://pobox.com/[/nofollow] that has a spam filter that in turn forwards the cleansed message to my real email address.
8)

Quote from: HiramAbif on April 21, 2010, 05:15:33 PM
I have a question.  I have guest posting enabled and there is one dude who is maliciously spamming my board using what I believe to be imacros.  Would this stop someone who floods the board with the same topic over and over again?  Thank you.

More clarification:
I use guest posting on my forum.  Besides this mod I use the standard smf "Anti-Spam Verification" (there are posts about this somewhere in this community that tell you how to set it up) for every non-member post in the guest area.  I do not have a spam problem in my guest area.
O:)

QuoteBlock china in your htaccess file!

Dp something like this list for your htaccess file.

Not  necessary for RC3, Bad Behavior stops the riffraff soooo very well.  ;D
Now 1.1.11, htaccess works to some degree, but still have spammers trying to use the quick reply with random IPs. ie: never use the same IP more than twice.

Quote from: Wizzlefits on May 04, 2010, 09:04:17 PM

QuoteNot  necessary for RC3, Bad Behavior stops the riffraff soooo very well.

Thanks for the feedback.  I am interested to know how it works on other sites besides my own.

Well, here's some feedback for ya.  ;)
Site Mods
Stop Spammer 2.3.7 (current state--On) Has caught nothing with BB turned on
httpBL 2.3.4 (current state--Off, but shows Honeypot trap link) will turn full on later
Bad Behavior 1.0.0 (current state---On)

176 spammers stopped in last 9 days
154 in last 7 days
2 spammers permitted to load 1 page then denied from then on.

METHOD: GET
URI: /index.php?board=24.0
PROTOCOL: HTTP/1.0
HEADERS: GET /index.php?board=24.0 HTTP/1.0 Accept: */* Host: www.xxxxx.com Referer: http://www.xxxxx.com/index.php?board=24.0 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)
AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)
ENTITY:
KEY: 00000000
PERMITTED REASON: Permitted
EXPLANATION:
ERROR: 200
xxxxx'd site out because it is not for public consumption, just for messing with spammers.  8)

Mod suggestions....
Just 1 so far, the option to sort logs by IP.

If there's anything else you'd like to know let me know. :)

Interesting.  Thank you for the info.  :)

I will look into the sort for the next version.  O:)

Permitted users are questionable and may not be real spammers.  The reason they are listed is because they should be watched.  If you find one please email me the details.   ???

Bad Behavior (BB) should be used in along with httpBL mod.   The current release version of BB includes honeypot but it does not have all the nice forum features as httpBL so I left that portion out.  A feature that I added that is not in the origional is that when you enable httpBL the Bad Behavior warning page includes a present in the form of the Honeypot trap link from httpBL.  The other unique feature is the optional SMF caching.   :o

Here is what happened on my site:
Stop Spammer 2.3.7 (current state--On) Has caught nothing since BB was turned on.
httpBL 2.3.4 (current state--ON, shows Honeypot trap link)
Bad Behavior 1.0.0 (current state--On, strict mode enabled)
avatar_verification_1.0 (current state--On, over 100 verification images)  Gets 5-10 hits a day but nothing has passed it.  The hits seem to be spammers who are getting caught by other means.

The trend I have seen is that with Bad Behavior in strict mode is that it blocks their proxies and other bad things.  I saw around 180-190 in my first week.  Then the humans tried turning off the proxy to get past BB but then the httpBL Mod caught them.

They were not happy with my site so they decided to assault me with a DOS -- over 300 hits/ day several times.  Every attempt failed with BB and httpBL enabled.  fyi - I made a lean httpBL warning screen that is like the BB warning screen just for my site to reduce bandwidth usage during these attacks.

After a several months they seem to have mostly given up.  Now I see only a few hits a day from both mods - Spam free!
8)

Mine says <!-- Bad Behavior 2.1.2 run time: 0.000 ms -->. Does that mean it's not running at all? Also, will this allow google bots to browse the forum?

I am not sure, it says ms in my source code. Thanks for the help, It seems to have stopped some spam :).

Quote1523     91.214.44.233     2010-05-08 12:50:06     /     DENIED
#b7830251
1520    91.214.44.233    2010-05-08 12:50:03    /iphone/index.php    DENIED
#b7830251
494    78.26.187.42    2010-05-08 12:32:52    /    DENIED
#b7830251
485    78.26.187.42    2010-05-08 12:32:49    /iphone/index.php    DENIED
#b7830251

Quote from: butchs on May 07, 2010, 01:25:31 PM
Interesting.  Thank you for the info.  :)

I will look into the sort for the next version.  O:)

Permitted users are questionable and may not be real spammers.  The reason they are listed is because they should be watched.  If you find one please email me the details.   ???

Bad Behavior (BB) should be used in along with httpBL mod.   The current release version of BB includes honeypot but it does not have all the nice forum features as httpBL so I left that portion out.  A feature that I added that is not in the origional is that when you enable httpBL the Bad Behavior warning page includes a present in the form of the Honeypot trap link from httpBL.  The other unique feature is the optional SMF caching.   :o

Here is what happened on my site:
Stop Spammer 2.3.7 (current state--On) Has caught nothing since BB was turned on.
httpBL 2.3.4 (current state--ON, shows Honeypot trap link)
Bad Behavior 1.0.0 (current state--On, strict mode enabled)
avatar_verification_1.0 (current state--On, over 100 verification images)  Gets 5-10 hits a day but nothing has passed it.  The hits seem to be spammers who are getting caught by other means.

The trend I have seen is that with Bad Behavior in strict mode is that it blocks their proxies and other bad things.  I saw around 180-190 in my first week.  Then the humans tried turning off the proxy to get past BB but then the httpBL Mod caught them.

They were not happy with my site so they decided to assault me with a DOS -- over 300 hits/ day several times.  Every attempt failed with BB and httpBL enabled.  fyi - I made a lean httpBL warning screen that is like the BB warning screen just for my site to reduce bandwidth usage during these attacks.

After a several months they seem to have mostly given up.  Now I see only a few hits a day from both mods - Spam free!
8)

Awesome, so should I install httpBL 2.3.4 too (will it conflict with this mod?) and how do I enable strict mode? Also I don't understand the cache thing. Mine is set to 0. Could you explain?

Thanks!

Quote from: Calumks on May 08, 2010, 08:12:13 AMAwesome, so should I install httpBL 2.3.4 too (will it conflict with this mod?)

You can install httpBL with no conflicts.

Quote from: Calumks on May 08, 2010, 08:12:13 AMand how do I enable strict mode?

Check "strict" under the security option in the admin panel.  See attached.

Quote from: Calumks on May 08, 2010, 08:12:13 AMAlso I don't understand the cache thing. Mine is set to 0. Could you explain?

If you click on the i next to cache duration the help will say: 

QuoteThe buffer time in seconds that the SMF Caching System is allowed to keep information for a readable IP address between Bad Behavior look-ups.  Because bots can look at multiple pages in your forum in a short amount of time this setting will allow either them or a visitor to view the forum or see the banned message within the duration using the least amount of processing effort.

If the SMF Caching System is not enabled you will get a warning message in the error log.

The time delay can be set between 0 and 99 seconds.  Zero disables this feature and prevents error log messages.  This number should be adjusted as low as possible based on server load.  Default is 0 seconds.

Quote from: Calumks on May 08, 2010, 07:17:05 AM
Mine says <!-- Bad Behavior 2.1.2 run time: 0.000 ms -->. Does that mean it's not running at all? Also, will this allow google bots to browse the forum?

That is because you are the admin and you are bypassed.  It does not check admins.  If your IP is not whitelisted, log out to see the speed.

More on caching duration since I am complicated.   Say you look at your cpanel and find the following bad bot hit your site:

Quote/smf/index.php?topic=724.0            
   Http Code: 302   Date: Mar 15 15:06:37   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?topic=724.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/            
   Http Code: 200   Date: Mar 15 15:06:45   Http Version: HTTP/1.0   Size in Bytes: 18214
   Referer: http://www.yourwebsite.com/         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=7.0            
   Http Code: 302   Date: Mar 15 15:06:52   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=7.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=24.0            
   Http Code: 302   Date: Mar 15 15:06:55   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=24.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?board=8.0            
   Http Code: 302   Date: Mar 15 15:06:58   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?board=8.0         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php            
   Http Code: 302   Date: Mar 15 15:07:02   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/index.php?action=forum            
   Http Code: 302   Date: Mar 15 15:07:04   Http Version: HTTP/1.0   Size in Bytes: -
   Referer: http://www.yourwebsite.com/smf/index.php?action=forum         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]         
/smf/warning.php            
   Http Code: 500   Date: Mar 15 15:07:07   Http Version: HTTP/1.0   Size in Bytes: 646
   Referer: http://www.yourwebsite.com/smf/warning.php         
   Agent: Opera/7.54 (Windows NT 5.1; U) [pl]      

Now look at the times:
15:06:37
15:06:45
15:06:52
15:06:55
15:06:58
15:07:02
15:07:04
15:07:07

The total duration of this bots rampage is 30 seconds (58-37+7+2).  So if you set cache duration to 8 Bad Behavior will check the bot 3 times during it's visit.  The remaining hits will be a repeat of the last check.

If the bot failed at "15:06:37" every hit on your site will be immediately rejected for 8 seconds.  After that it will check again at "15:06:45".

To date I have not seen a bot fail the first hit and ever pass a second hit.  But someday that may happen.

Standard Bad Behavior does not include this feature.  It is fast enough to check every hit.  This feature should only be used when you have a really bad bot problem or your site is large.
:o

Quote from: Calumks on May 08, 2010, 07:53:26 AM
I am not sure, it says ms in my source code. Thanks for the help, It seems to have stopped some spam :).

Quote1523     91.214.44.233     2010-05-08 12:50:06     /     DENIED
#b7830251
1520    91.214.44.233    2010-05-08 12:50:03    /iphone/index.php    DENIED
#b7830251
494    78.26.187.42    2010-05-08 12:32:52    /    DENIED
#b7830251
485    78.26.187.42    2010-05-08 12:32:49    /iphone/index.php    DENIED
#b7830251

Yes it did.  If you do not have IE click within the highlighted area for more details.  If you have ie click on the underlined denied text to see the details.

<!-- Bad Behavior 2.1.2 run time: 0.000 ms -->

Quote from: Arantor on May 08, 2010, 07:18:22 AM
No, that means it ran so quickly it didn't even taken 1/1000 of a second (I think ms is wrong here, unless you're really measuring 1/1,000,000th of a second)

I really did not look at that part too much since it was part of the std BB package.  EDIT  :)

EDIT:
Now I am soooo confused.   :-[

ms was correct.  It multiplies 1000 to the number before displaying it.


having a bad bad day...  ;)

and yes, that time measurement code does display in slower blogs/ forums.

Bla, you tell me...

start:
$bb2_mtime = explode(" ", microtime());
$bb2_timer_start = $bb2_mtime[1] + $bb2_mtime[0];

end:
$bb2_mtime = explode(" ", microtime());
$bb2_timer_stop = $bb2_mtime[1] + $bb2_mtime[0];
$bb2_timer_total = $bb2_timer_stop - $bb2_timer_start;

display:
echo "\n<!-- Bad Behavior " . BB2_VERSION . " run time: " . number_format(1000 * $bb2_timer_total, 3) . " ms -->\n";

:)

I have httpbl & stopspammer... and not getting any problem. Do I need to use this mod also?

in fact let me know which is the best combination of mods?

I use all three:
:D

My list:

• Stop Spammer 2.3.7 (current state--On)
• httpBL 2.3.4 (current state--ON, shows Honeypot trap link)
• Bad Behavior 1.0.0 (current state--On, strict mode enabled)
• avatar_verification_1.0 (current state--On, over 100 verification images)

Installed and working withour errors on RC3.

Followed the instructions, edited what needed to be edited and did the two part install.

Other than needing to chmod a few items ( my fault ), the install went without any problems.

Thanks

Lou  :)

It has been six(6) months since I have deleted a spammer!
8)

Mods still working well with my site too! The only spam I have got is from humans.

Thank You very much!!!

I replicated a spam bot and got

QuoteError 403


We're sorry, but we could not fulfill your request for
/ on this server.


An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.


Your technical support key is: 41af-850f-1756-6707


You can use this key to fix this problem yourself.


If you are unable to fix the problem yourself, please contact calumks at gmail.com and be sure to provide the technical support key shown above.




Warning:  Missing argument 2 for smf_db_query(), called in /home/public_html/iphone/Sources/bad-behavior/BadBehavior-SMF.php on line 70 and defined in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 235



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 263



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 267



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 277



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 322



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 345



Notice:  Undefined variable: db_string in /home/public_html/iphone/Sources/Subs-Db-mysql.php on line 372

Query was empty

Should I be getting those errors?

Was the whole quote in the warning message?

If not please fix it so I can understand.

The whole warning message is in the quote, if that's what you mean?

Yes, I was not sure if it was the warning post and the SMF error log combined in the quote.

That should not happen.  I have not seen that before.  I need to try to duplicate that and see if it is indeed BB or another mod interfering.

Did you use "Bad Behavior Test" in the UA (if not what did you do) as the simulation?
Did it record your visit in the "DENIED Entries Log"?
Were there any entries in the log before you did the test or was it empty?
:)

Well, it could be because I wasn't trying to be a spam bot. I was trying to see my theme's browser compatibility and one of the ways of doing that made the forum think I was a spam bot. I'm afraid I'm not sure if it was in my denied entries log. There were entries in the log before I did the test and how do I do the Did you use "Bad Behavior Test" in the UA again?

To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.

• Windows use FireFox with the [nofollow]"Modify Headers" (https://addons.mozilla.org/en-US/firefox/addon/967)[/nofollow] add-on.
• Macintosh, [nofollow]"enable the Develop menu" (http://macs.about.com/od/usingyourmac/qt/safaridevelop.htm)[/nofollow] in Safari.

This error only appears when I view "http://ihackmyi.com" if I view "http://ihackmyi.com/iphone/index.php" no errors are displayed.

Look at the attachments.

Both of them give me "Query was empty" at the end.  This is saying that it can not write to the database because the information does not exist.  But the information does exist otherwise it would have never made it to the "error message" in the first place.  Something is preventing the transfer of data from BB to the SMF database.  At this point it looks like something on your end.  So:

1.  "Subs-Db-mysql.php" may be corrupted.  Try to back it up and reinstall this file from the SMF master disk.
2.  Maybe the installation of BB is corrupt.  A re-installation of both parts would be a good idea.
3.  You cold have a forum permission problem.  Make sure the permissions for the BB files comply with SMF standards.

If that does not work I will need more detail.

Thanks, I fixed the problem by reinstalling the mod. I think I installed them the wrong way round.

I am glad to hear that it was a easy fix.
:)

Big update to BB 2.1.4 posted today.  Here are the updates:

---

1.  The mod supports 2.1.4 BB (now new install part 1) and a nasty Forum Spammer has been added to the ban list.
2.  Changes to BB 2.1.4:

• A logic error in the CloudFlare code introduced in 2.1.3 caused installation or upgrading to fail under some circumstances, and caused a fatal error on systems which are using CloudFlare. This code has been rewritten.
• A web crawler used by Facebook was inadvertently blocked because it engages in some unusual behavior. This could cause links to protected pages to appear on Facebook without their title, photo or description. This issue with Facebook's crawler has been worked around.
• In rare configurations, the Firefox and Safari web browsers may send the nonexistent "Proxy-Connection" HTTP header. Old versions of Internet Explorer may also send this header in their default configurations. This usually occurs when the web browser is configured to connect to an (obsolete) HTTP/1.0 proxy or has been explicitly configured to use HTTP/1.0 when talking to a proxy, even if the proxy understands HTTP/1.1. This header originated with a proposal made by (then) Netscape which was rejected for inclusion in HTTP in 1998 due to its causing interoperability problems. Bad Behavior checks for this header as it has historically made an excellent indicator of malicious activity if it is seen at the origin server, because proxy servers are expected to strip the header. Because of the slight possibility of blocking legitimate users, this check is now active only in strict mode. (Thanks to Mark Nottingham for reporting this issue.)
• A workaround for a problem with PHP on IIS servers has been implemented. This issue caused various parts of Bad Behavior's functionality to fail on IIS. (Thanks to Michael Kingery for reporting this issue.)
• New code which implements "round-trip DNS" for verifying that an IP address belongs to a specific entity is now being used to verify Googlebot and MSNbot. This code replaces the old hard-coded IP addresses.
• Support for the CloudFlare reverse proxy service has been added. Users of this service should now be able to use Bad Behavior successfully. (Thanks to Matthew Prince at Project Honey Pot for his assistance with this implementation.)

---

The big addition to the mod is CloudFlare support.  This mod is fully compatible with my CloudFlare mod (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).  If you are using CloudFlare and this mod please make sure both mods are installed.

You MUST completely uninstall both part 1 and 2 and reinstall the new version part 1 and 2 of thios mod.  Do not forget to backup your "whitlist.ini" file.

Enjoy!!

I just got this all over my portal

QuoteDeprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Deprecated: Function ereg() is deprecated in /home/iplod1/public_html/forum/Sources/bad-behavior/bad-behavior/functions.inc.php on line 62

Had to disable the mod. What could be the problem?

If you installed the new "bad_behavior_install_pt1of2" you will see that there is only comment code on that line.  It is obvious to me that you are mixing the old bad behavior with the new mod.

Try backing up your "whitlist.ini" file and uninstalling both "Bad Behavior install" and "Bad Behavior Mod" and downloading and reinstalling "bad_behavior_install_pt1of2 and "bad_behavior_install_pt2of2.

When you have the correct versions installed you should see the following in package manager:

Bad Behavior install    2.1.4
Bad Behavior mod    1.1.0

:)

There is a difference for the user between the old whitelist.ini and the new whitelist.

New is:

[useragent]
useragent[] = "Mozilla/4.0 (It's me, let me in)"


Old is:

[useragent]
; This is an example; you should remove it
; useragent[] = "Mozilla/4.0 (It's me, let me in)"

Is the change intentional?

thanks

You are correct you need to remove it as follows:

; useragent[] = "Mozilla/4.0 (It's me, let me in)"

thanks ... just wanted to make sure that was the intent

:)

The CloudFlare portion of Bad Behavior 2.1.4 dies not work with CloudFlare.  I am currently debugging 2.1.5 and expect to be able to release Bad Behavior 2.1.5 soon.  Along with a mod and whitlist update.

New Version Posted today.

BB Mod 1.2.0
BB core 2.1.5
whitelist.ini

Mod changes:
Fixed email -  Streamed lined code and improvement for ip address.
Automatic detection of CloidFlare and IP addresses were resolved.

Core Changes
Improvements for CloudFlare.
The next official version will include some of the changes that are being installed by the above mod.
MSN bot error fixed.
ereg() is deprecated error fixed.

Whitelist Changes
Compatible with older versions of the mod.  Whitelist has been looked at more closely and comments were added.
More things are blocked to make it even more effective.
Only the base features were not commented.
This version is part of 2.1.5 and is recommended as a starting point for all users.
Your database server should be checked see (admin/Server Settings/Database and Paths/Database Server).

:D

I want to say that this mod is amazing for SMF. I've had it installed for 3 days and these are the stats so far (running in strict mode):

Site #1:
2,622 Denied entries
20 Permitted entries

Site #2:
712 Denied entries
13 Permitted entries

Working great!

Quick question, if I want to move to 2.1.7 of Bad Behavior I just need to grab the files from the bad behavior site and drop them into the right location on the server, right?

That is good news.  You should see a drop in a few weeks as they give up.

There is no need to upgrade.  I submitted the changes that were used in the mod to BB to make BB version 2.1.7.  So latest version of the mod (part 1 and part 2) has everything that is in BB 2.1.7.

Will this run with RC4? I tried to install it and got a 'corrupt package' error.

Quote from: meadwench on September 20, 2010, 10:05:48 AM
Will this run with RC4? I tried to install it and got a 'corrupt package' error.

RC4 there is no official release of 2.0 RC4!  Maybe you mean RC3?

I sounds like there was an error either uploading to SMF or downloading the package from SMF.  If you are getting a package error try downloading the package again and reinstall.

Oops. sorry. I meant to say *Beta* 4.....

I'll try downloading again.....

OK, just re-downloaded it. I was able to upload it to my site, but when I go to install it says "The package you are trying to download or install is either corrupt or not compatible with this version of SMF."

Thoughts?

the upgrade package cannot be used through the package manager

for upgrading please see Upgrading SMF (http://docs.simplemachines.org/index.php?board=3.0;sort=subject)

If you upgrade to SMF 2.0 RC3 it will work.
O:)

Ah ha. Will do!

Yep, that worked. ::sigh:: Been spending too much time in other forum software, I fell behind in SMF! Thanks for the poke in the head to get my brain working again. Now to get this thing configured.....

This is a great mod with a not-so-helpful installation guide, which clearly is aimed at people with a fair degree of pc knowledge. Sorry but you lost me at the white.ini editing instructions and then the bad string thing. Whatever that is. Like the honeypot mod, this needs a simpler way to install it or some kind of an Installation for Dummies tutorial which doesn't presume that the person doing the installing is a tech-boffin.

Sorry I guess I do not know how to do dummy tutorials.  If you like to take on the dummy project you have my permission.

Did you look at readme in the "bad_behavior_install_pt1of2" zip file?

QuoteIt is recommended that you open /bad-bfolder/whitelist.ini and make the following changes:

Search for:
Code: [Select]
ip[] = "localhost"
Replace the word localhost wiht the IP address of your database if it is not localhost.

Starting on the next line enter:
ip[] = "xx.xx.xx.xx"
ip[] = "yy.yy.yy.yy"
Where xx.xx.xx.xx is the Admins IP address.
Where yy.yy.yy.yy is the Shared IP Address.

Save, then re-zip the package and install it on your forum like any other package.

If you do not want to open the package then install "The SMF File Management Tool" and edit the whitelist on the fly.

The above assumes that you are installing the mod in a forum that is a "smf" directory.

I did a manual install and made sure all code was copied and replaced correctly, have gone over it 5 times now. However the last bit I can't get past is the install_db.php, it gives me:

Database Error
No database selected
File: /var/www/dddd/xxxxx/zzzz/httpdocs/install_db.php
Line: 71
Back

I did make sure it is in the same folder as index.php, ssi.php etc, and I am not under the SMF directory. My website is the forum, so www.mywebsite.com instead of www.mywebsite.com/smf/

Also it shows up in admin section just fine, except logs give me error

Table 'db.smf_log_badbehavior' doesn't exist
File: /var/www/zzz/sss/dddd/httpdocs/Sources/BadBehavior-Admin.php
Line: 244

which is due to install_db.php not running..?

I am running Dzine, Overview theme.

Thanks in advance, hope to get this mod up and running.

The 'db_extend" packages was not loading.  Try the attached.

@ mojosplurr As you told me somewhere else, you tried with that install_db.php file and still are getting the same "Database Error ...".

Try with this one instead. I think you will be able to install the DB now without errors.

Mr show off?   Glad to see you are stepping up since I am done programming for a while.  ;)

installing in rc4 without a problem

Quote from: butchs on November 02, 2010, 08:28:10 PM
Mr show off?   Glad to see you are stepping up since I am done programming for a while.  ;)

A pity. I thought you were going to say I had another mistake somewhere.

You see: I wanted to win another free beer.  8)

Egads, you go there after all that help I gave you?  Please do not try to taunt me.

It was fun but, no more time for php until the holidays.  Gotta real job now...

Quote from: flapjack on November 02, 2010, 08:34:40 PM
installing in rc4 without a problem

Yay!  That is great news!

To install the mod in RC4 do the following:

Download both parts of the mod.

Go to package manager:

Click on "Advanced" in lower right.

Change Emulate Version to:  SMF 2.0 RC3

Install part 1 and then part 2 of the mod.

Enjoy.

There is a RC4 update to this mod but I can not download it because SMF is blocking me.

QuoteAn Error Has Occurred!
The package id given in the uploaded file does not match the package id given by previous versions of this mod.
Package id in database: Bad_Behavior_mod
Package id in the uploaded file: Bad_Behavior_install

It will be updated when whoever at SMF decides to allow me to download the two(2) parts of this mod and when I have free time...

The changes that I am not able to download are as follows:

• Improved roundtripdns and cache.
• Added yahoo check (will temporarily reports error as msnbot - waiting for BB to catch up)
• Scheduled task for auto purge of BB cache.
• Removed cloudflare check due to DNS issues at cloudflare.
• Fixed RC4 bugs in admin area that prevented saving settings and displaying of detailed reports.
• Mod now has its own cache, it no longer requires SMF caching to be enabled.

Quote from: butchs on November 06, 2010, 10:13:35 AM
An Error Has Occurred!
The package id given in the uploaded file does not match the package id given by previous versions of this mod.
Package id in database: Bad_Behavior_mod
Package id in the uploaded file: Bad_Behavior_install

It doesn't matter if your mod has one file or a lot of them. Inside all the files the id need to be exactly the same one.

So if the id in the first file you uploaded to SMF (when you started this mod) was:


<id>JMiller:Bad_Behavior_mod</id>


All the rest of the files need to have exactly that id.

Of course inside every file you can change the name and version:


<name>whatever name you want for every file</name>
<version>whatever version number it is</version>


But you cannot change the id.

I tried that on my test server and it did not work.  I am sure SMF can sort it out...
:'(

The new version is in the mod section.

The big change is that it no longer requires your server to have cache capabilities.  See reply 82 for details.

I want to say how thankful I am for this mod. I've been using if for a few months and it's still knocking out like 400 requests per day (strict mode) without any adverse consequences for my users.

You are welcome.  That is what Bad Behavior (BB) is about!

With your traffic you should try my new mod.  As a minimum you should al least use the ip address (ipv4 and ipv6) check along with the DOS prevention features.  Run it on logging mode for a few days before blocking.  My new mod has been waiting for SMF approval for 1 day short of a month.  I programmed/ tested to for more than six(6) months, it is by far my best anti-spam effort to date.  Along with BB you will see even more wasted bandwidth go away so your members can enjoy your site.

I think it is simply sitting in never-never land because it is a security mod and SMF wants to cover up security flaws and make it look like it has no security issues with SMF.  But the reality of my new mod is not about pointing out flaws in SMF but to rid the forum of bad visitors that try to pass known security flaws in other software...  These are the ones you do not want at your site.  I prefer to block ban bots/ people than to sanitize them like SMF.  Let SMF sanitize the posts, use there filters, give them a warm and cosy so they want to try more things.  Forum Firewall is all about chasing the unwanted away...

If you like you can find it at P.C. Tweakr (http://forum.pctweakr.com/index.php/topic,499.0.html).
O:)

Hi!

First great anti-spam mod, I have used several of them (httpbl, stop spammer), and yours is the only one to prevent 99,999% of the spam to reach my board (I need to have some boards fully open to posting from guests, so spam is a big problem for me).

Now, I've installed rc4 on a test site, (done a clean new install), then wanted to import through phpmyadmin the database of my main forum (rc3). It gives me this error:

QuoteCREATE TABLE `hip_log_badbehavior` (
id int( 11 ) unsigned NOT NULL AUTO_INCREMENT ,
ip varchar( 16 ) NOT NULL default '',
date varchar( 255 ) NOT NULL default '0000-00-00 00:00:00',
request_method varchar( 4 ) NOT NULL default '',
request_uri varchar( 255 ) NOT NULL default '',
server_protocol varchar( 15 ) NOT NULL default '',
http_headers varchar( 255 ) NOT NULL default '',
user_agent varchar( 255 ) NOT NULL default '',
request_entity varchar( 255 ) NOT NULL default '',
KEY varchar( 255 ) NOT NULL default '',
PRIMARY KEY ( id ) ,
KEY ip( ip ) ,
KEY user_agent( user_agent )
) TYPE = MYISAM ;

Quote#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'varchar(255) NOT NULL default '',
PRIMARY KEY (id),
KEY ip (ip),
KEY user_' at line 11

Do you know if this comes from your mod, what it is? could it come because I'm trying to import a db from a rc3 forum to a rc4 one?

It is my understanding that when you change SMF version the SMF installer updates the database.  So if you attempt to to run a SMF RC3 database in RC4 you can get an error.

I recommend setting up a test server or a dummy server on the net and import the RC3 database in to a fresh copy of RC3 with no mods.  Upgrade the RC3 to RC4, which will update the database.  Back up the RC4 database, remove the software and install the RC4 database in your live MASTER RC4 with no mods installed.  Reinstall all mods and rock on...  :o

Thanks a lot!

I can see instructions that sya "install part 1 then part 2 of this Mod" but nowhere can i find the instructions of how to do this install, can someone point me in the right direction

You found them.  First you download and install part 1.  Then you download and install part 2.  :)

Hi butchs,

this is areally awesome mod!
Is there also a version for SMF 1.1?

Regards,
ripystys 8)

I'm very sorry about this but I am a complete and utter novice.  I have set up a forum using smf 1.1.12, I've used forums and am quite comfortable just using them.  I wanted to stop some of the spam I've been getting as I really don't want to buy any ugg boots and that's what they all seem to be selling!

I have downloaded parts 1 and 2 and the whitelist ini but now have what is probably a stupid question to you knowledgable ones.  In the part 1 readme.txt it says this

It is recommended that you open /bad-bfolder/whitelist.ini and make the following changes:

Search for:
Code: [Select]
ip[] = "localhost"
Replace the word localhost wiht the IP address of your database if it is not localhost.

Starting on the next line enter:
ip[] = "xx.xx.xx.xx"
ip[] = "yy.yy.yy.yy"
Where xx.xx.xx.xx is the Admins IP address.
Where yy.yy.yy.yy is the Shared IP Address.

Well my database is hosted on my site so I assume I can leave that as locahost but am not sure what is meant by Admins IP address and Shared IP Address?  Is the Admin IP address the address of my home pc?  And Shared IP Address?

Sorry for asking what are basic questions.

Sorry this mod does not work with smf 1.1.x.

This mod is kinda hard to install, and I have some questions.

I have SMF 2.0 RC3

Before I uploaded to Packages and installed it, I extraced it to my desktop and opened the folder and inside it I found whitelist.ini and I found ip[] = "localhost" and changed it to ip[] = "mysql.mysite.orgy".............will that work?.....that is what was in my server info!

Starting on the next line entered:
ip[] = "MY IP address"
ip[] = "yy.yy.yy.yy" (I left this off, because I have NO CLUE what a shared address is....will it work?)


I saved it, then re-zipped the package and installed it on my forum like any other package.


I edited my .htacces to include the time zone per the instructions


#--- DH-PHP handlers ---
AddHandler fastcgi-script fcg fcgi fpl
AddHandler php-fastcgi .php
Action php-fastcgi /cgi-bin/dispatch.fcgi
Options -Indexes
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html

#Set the timezoneSetEnv TZ America/Chicago

^^^^Will that work?^^^^



I don't think it is working, because I don't have any error logs......and still have bots trying to log in guessing members passwords!!!

I enabled Verbose HTTP logging, and got 59 in just a couple of minutes......does that mean it is working?


I noticed bots that were in my block list trying to log in with usernames so I changed my .htacess to this.....do you see a problem with it?


#Set the timezoneSetEnv TZ America/Chicago
#--- DH-PHP handlers ---
AddHandler fastcgi-script fcg fcgi fpl
AddHandler php-fastcgi .php
Action php-fastcgi /cgi-bin/dispatch.fcgi
Options -Indexes
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html
<Limit GET HEAD POST>
order allow,deny
# ACAMS Pissed off
deny from 108.1.174.239
deny from 108.41.42.137
deny from 109.169.29.56
deny from 109.169.29.56
deny from 109.169.41.48
deny from 111.1.32.23
deny from 111.1.32.24
deny from 111.1.32.25
deny from 111.1.32.26
deny from 124.106.204.40
deny from 124.148.154.221
deny from 125.255.2.30
deny from 128.6.224.107
deny from 137.30.164.165
deny from 137.56.163
deny from 140.180.130.93
deny from 142.68.83.148
deny from 144.85.24.218
deny from 144.92.92.15
deny from 150.140.188.242
deny from 150.70
deny from 155.239.155.200
deny from 173.193.221
deny from 173.193.221.27
deny from 173.193.221.28
deny from 173.255.238.178
deny from 173.48.174.212
deny from 173.54.2.133
deny from 173.54.2.197
deny from 174.138.169.218
deny from 174.36.199
deny from 174.36.199.200
deny from 174.36.199.201
deny from 174.36.199.202
deny from 174.36.199.203
deny from 178.18.17.250
deny from 178.239.55.32
deny from 178.33.149.173
deny from 178.63.198.71
deny from 178.63.246.164
deny from 178.73.209.99
deny from 178.78.255.254
deny from 18.246.0.69
deny from 180.149.96.69
deny from 184.99.175.66
deny from 188.120.245.249
deny from 188.124.19.114
deny from 188.134.24.234
deny from 188.40.51.2
deny from 188.40.98.60
deny from 188.72.223.162
deny from 188.72.225.172
deny from 188.72.241.209
deny from 192.251.226
deny from 192.251.226.205
deny from 192.251.226.206
deny from 193.138.216.157
deny from 193.198.207
deny from 193.198.207.8
deny from 194.145.200.128
deny from 194.154.227
deny from 195.43.157.85
deny from 195.71.226.87
deny from 199.48.147
deny from 199.48.147.35
deny from 199.48.147.35
deny from 199.48.147.36
deny from 199.48.147.37
deny from 199.48.147.38
deny from 199.48.147.39
deny from 199.48.147.40
deny from 199.48.147.41
deny from 199.48.147.42
deny from 199.48.147.43
deny from 199.48.147.45
deny from 202.71.106.147
deny from 202.81.69.142
deny from 203.174.87.18
deny from 204.152.222
deny from 204.152.222.140
deny from 204.8.156.142
deny from 206.221.217.246
deny from 208.115.203.16
deny from 208.66.135
deny from 208.66.135.190
deny from 208.66.135.190
deny from 208.75.57.100
deny from 208.75.88.34
deny from 209.159.142.164
deny from 212.13.195.235
deny from 212.42.236.140
deny from 213.112.111.205
deny from 213.154.227.205
deny from 213.165.81.179
deny from 213.239.192.229
deny from 213.46.138.76
deny from 213.46.88.109
deny from 213.49.109.9
deny from 216.115.3.26
deny from 216.24.174.245
deny from 216.243.32.170
deny from 216.86.61.205
deny from 217.15.23.215
deny from 217.19.50.77
deny from 217.20.114.254
deny from 24.106.191.235
deny from 24.192.171.225
deny from 24.247.220.16
deny from 38.102.94.125
deny from 46.4.160.39
deny from 46.4.237.146
deny from 50.15.57.221
deny from 50.16.134.106
deny from 50.22.180.2
deny from 58.247.181.212
deny from 60.242.34.204
deny from 61.47.35.34
deny from 62.141.53.224
deny from 62.141.58.13
deny from 62.212.67.209
deny from 62.24.181.134
deny from 62.24.181.135
deny from 62.75.139.221
deny from 62.75.159.139
deny from 62.75.185.133
deny from 64.120.209.40
deny from 64.27.17.140
deny from 64.34.162.160
deny from 66.230.230.230
deny from 66.233.158.229
deny from 66.96.16
deny from 66.96.16.32
deny from 67.207.136.44
deny from 68.126.24.162
deny from 68.71.46.138
deny from 69.163.34.69
deny from 71.129.110.137
deny from 71.198.26.88
deny from 71.244.55
deny from 71.244.55.170
deny from 72.47.252.215
deny from 74.106.13.137
deny from 74.106.17.110
deny from 74.110.86.176
deny from 74.208.243.167
deny from 74.208.246.213
deny from 74.208.246.222
deny from 74.3.165.39
deny from 76.10.214.53
deny from 76.10.214.89
deny from 76.253.141.244
deny from 77.109.139.87
deny from 77.207.206.122
deny from 77.220.41.47
deny from 77.232.135.67
deny from 77.37.136.160
deny from 77.54.97.144
deny from 78.107.237.16
deny from 78.153.153.8
deny from 78.225.101.56
deny from 78.42.9.166
deny from 78.46.39.228
deny from 78.47.240.52
deny from 78.47.251
deny from 78.48.204.3
deny from 79.120.86.20
deny from 79.136.50.205
deny from 79.140.39.227
deny from 80.237.226.75
deny from 80.237.226.76
deny from 80.62.217.18
deny from 80.81.183.178
deny from 81.169.155.246
deny from 81.169.173.120
deny from 81.218.219
deny from 81.218.219.122
deny from 82.209.175.58
deny from 82.224.122.209
deny from 82.228.252.20
deny from 82.245.41.171
deny from 83.142.228
deny from 83.142.228.14
deny from 83.168.210
deny from 83.168.210.55
deny from 83.169.9.70
deny from 83.170.92
deny from 83.170.92.9
deny from 83.220.133.86
deny from 83.226.245.207
deny from 83.80.129.253
deny from 83.86.110.188
deny from 84.25.173.164
deny from 84.75.174
deny from 85.114.135.224
deny from 85.114.141.18
deny from 85.17.92.13
deny from 85.214.73.63
deny from 85.235.31.248
deny from 85.25.144.101
deny from 86.101.114.199
deny from 86.201.237.21
deny from 86.205.122.125
deny from 86.81.118.37
deny from 87.118.104.203
deny from 87.126.133.230
deny from 87.236.194
deny from 87.236.199
deny from 87.236.199.73
deny from 88.189.58
deny from 88.208.121.151
deny from 88.80.29.99
deny from 89.176.88.245
deny from 89.208.236.35
deny from 89.208.237.70
deny from 89.253.105.39
deny from 89.253.97.235
deny from 89.77.213.43
deny from 91.118.57.238
deny from 91.121.175.151
deny from 91.213.50
deny from 91.213.50.235
deny from 91.214.30.60
deny from 91.216.191.11
deny from 91.67.236.41
deny from 92.101.211.233
deny from 92.241.168.146
deny from 92.241.174.9
deny from 92.241.184
deny from 92.241.184.106
deny from 92.241.190.129
deny from 92.241.190.168
deny from 92.241.190.188
deny from 92.247.192.176
deny from 92.9.221.213
deny from 93.104.215.8
deny from 93.115.241
deny from 93.156.76.66
deny from 93.157.46.163
deny from 93.167.245.178
deny from 93.31.155.175
deny from 93.50.137.186
deny from 94.132.72.2
deny from 94.19.12.244
deny from 94.249.153.47
deny from 94.251.75.55
deny from 94.27.70.144
deny from 94.75.253.73
deny from 95.142.174.176
deny from 95.143.193.145
deny from 96.226.21.90
deny from 96.255.16.21
deny from 97.107.142.93
deny from 98.113.149.36
deny from 98.191.188.71
deny from 91.66.107.36
deny from 74.110.86.138
deny from 217.114.211.20
deny from 178.32.95.23
deny from 107.5.17.164
deny from 87.194.9.111
deny from 64.34.184.153
deny from 64.83.196.144
deny from 74.208.231.162
deny from 217.114.211.20
deny from 109.202.66.4
deny from 190.183.221.175
deny from 91.66.107.36
deny from 85.17.97.6
deny from 91.218.39.92
deny from 24.83.197.147
deny from 95.142.174.183
deny from 78.40.42.152
deny from 80.232.240.249
deny from 78.34.189.131
deny from 66.8.120.130
deny from 93.125.165.43
deny from 88.198.109.35
deny from 168.144.48.133
deny from 194.0.229.54
deny from 217.160.221.7
deny from 78.34.148.210
deny from 88.162.37.58
deny from 95.105.224.155
deny from 96.226.21.242
deny from 208.110.65.123
deny from 46.28.108.24
deny from 193.34.144.124
deny from 62.141.53.224
deny from 192.251.226.205
# bots be gone
allow from all
</LIMIT>


Yes BB is working.

I can not vouch on your htaccess file since the requirements differ host by host.

As far as your list goes it is a waste of time since the bots change their ip often.  You could end up blocking a good user.

I would prefer to see you add a better robots.txt file.  Search this site there are a few discussions on robots.txt.

If you insist on blocking ip via htaccess then do it by country and a few notable locals in your own country.

Quote from: ripystys on January 07, 2011, 04:00:22 AM
Hi butchs,

this is areally awesome mod!
Is there also a version for SMF 1.1?

Regards,
ripystys 8)

Working on a new version.  Lots of improvements and changes.  Added SMF 1.1.x functionality.  I will be running beta tests for a few weeks at SMF HELPER (http://community.smfhelper.info/index.php/topic,5187.0.html).  So follow the link if you will like to try it.  I will test it there at least two weeks fore the official release.

I have a member that is blocked and he gave me the technical support key number, but I have over 3000 entries in the block log.......How do I unblock him?

Two ways:

1.  You can go to the BB (http://www.bad-behavior.ioerror.us/) Website and make a request.
2.  Add him to the whitelist.  In the last release version that will require you to add his ip address to the whitelist.ini file.  The beta will be a permission change.

Thanks, I think we have it worked out.

It is recommended that you completely uninstall this mod before applying the new "SMF 2.0 RC4 Security Patch".  You can reinstall the mod afterwards.

New version, BB 2.1.11 support, works behind reverse proxies, "Search Engine DNS" check box, lots of changes and SMF 1.1.13 compatibility.

Looking at the download page for this mod, I see that it does not parse for the 2.0 RC4 + Security Patch but will parse for the RC 5. Is this indeed a fact or just an oversite showing the RC 4 + SP is not parsable?

thanks

I have the security patch and it installs just fine on my server.

But if you experience this go to "Admin/Package Manager/Browse Packages".  Click "Advanced Options" and confirm that "Emulate Version" is "SMF 2.0 RC4".
8)

Thanks butchs, I will give it a go. If it worked for you then I am certain it shall work for me.

By the way, a 'thumbs up' on this mod and your ForumFirewall. The bad actors are being deflected by the bucket load.

thanks,

Lou

Every few hours I get this error logged...

QuoteDatabase Error: No database selected
File: /home/mydomain.com/public_html/smf/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

The errors correspond to 'users' hitting the httpBL warning.php file if that's significant.

Having an issue with the mod I think when I turn it on I get the following error at the bottom of all pages. Any idea how I fix it?

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '}log_badbehavior AS bb
WHERE id >= 0' at line 2
File: /home/xxx/public_html/xxx/Forums/Sources/bad-behavior/BadBehavior-SMF.php
Line: 496

Note: It appears that your database may require an upgrade. Your forum's files are currently at version SMF 1.1.13, while your database is at version 1.1.5. The above error might possibly go away if you execute the latest version of upgrade.php.

Badb.  ver 1.4

When clicking on the  "key" col  in the denied records I get  a 404 error, is this correct?

DENIED
#17566707tuy

Quote from: hardcore_f on February 21, 2011, 05:54:13 PM
Badb.  ver 1.4

When clicking on the  "key" col  in the denied records I get  a 404 error, is this correct?

DENIED
#17566707tuy

You should not get any errors as long as you are logged in as the admin.  Seems you logged out or your session expired.

17566707 means and invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.  Required header \'Accept\' missing'.

Quote from: packman on February 21, 2011, 02:31:59 AM
Every few hours I get this error logged...

QuoteDatabase Error: No database selected
File: /home/mydomain.com/public_html/smf/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

The errors correspond to 'users' hitting the httpBL warning.php file if that's significant.

Odd, I have used both with no issues.  But I use SMF 2.0.  I need to get more info so I can find out what is going on...  But for now I will blame my bud snoopy.   ;)

Quote from: ac19189 on February 21, 2011, 05:50:02 PM
Having an issue with the mod I think when I turn it on I get the following error at the bottom of all pages. Any idea how I fix it?

I believe I am working with you over at SMF helper.  Lets do it in one place to keep things neat.  I am going to do what I can do to help you but please be patient with me because I have little time during the week to support my mods.  But is seems you have more of a forum installation issue and those SMF Helper guys are better than me with that stuff...
8)

butchs, I have an odd situation with B.B. and httpBL. It is a test forum that I have allowed bots into just to test B.B., so it is not an urgent issue.  I have a denied entry for an IP that I can confirm is a bad bot, but it seems to be a minor conflict with httpBL. My log shows that IP being caught by httpBL at 10:11:30, and the B.B. logs that it denied the IP at 10:11:32 from going to warning.php, which of course is where httpBL had just redirected it. It is not an issue to me, the bot was stopped, but I am wondering if this has been seen before, or am I the first?

New version posted today.  It only contains changes for SMF 1.1.x.  SMF 2.0 RCx users need not upgrade.

Quote from: busterone on February 22, 2011, 05:49:21 PM
butchs, I have an odd situation with B.B. and httpBL. It is a test forum that I have allowed bots into just to test B.B., so it is not an urgent issue.  I have a denied entry for an IP that I can confirm is a bad bot, but it seems to be a minor conflict with httpBL. My log shows that IP being caught by httpBL at 10:11:30, and the B.B. logs that it denied the IP at 10:11:32 from going to warning.php, which of course is where httpBL had just redirected it. It is not an issue to me, the bot was stopped, but I am wondering if this has been seen before, or am I the first?

Sounds like snoopy is not ending php properly even after I told him how to do it several times.  He never listens to me...   :'(

Try this:

Search "warning.php" for "?>" and replace it with
"die();
?>".

That should force httpbl to stop further activity.

Done. Will watch and see. Thanks.   :)

Quote from: busterone on February 22, 2011, 07:25:15 PM
Done. Will watch and see. Thanks.   :)

If I am correct, you get ot tell snoopy he goofed again.  If I told him, he will stalk me for a week.   :o

LOL.  ;D

Hah...  My site just proved that bots can pass thru httpbl unblocked!  Httpbl loads before BB so if a bot was stopped it would not reach BB.  A bot hit warning php but then then was blocked by BB.   8)

BB does have project honey pot capabilities, though not as good as httpbl but it does stop the bot.  BB author insisted that I retain all the capabilities.  So if you can not wait for snoopy to fix his code go to phpmyadmin in the "settings" DB entry and populate the following:

badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage

Since this is on a test forum, I populated the db to see what happens.   :)   

Quote from: butchs on February 22, 2011, 07:40:39 PM
badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage

httbl_key is obvious, but the other two values aren't quite so obvious? The httpBL mod has two threat values and three values that might correspond to maxage, or maybe your values mean something completely different?

Here is what is happening.  BB is loaded after httpbl mod and httpbl mod (not associated with this mod) is allowing the bad guys to pass thru only to get blocked by this mod BB.


:o

Quote from: packman on February 23, 2011, 02:20:05 AM

Quote from: butchs on February 22, 2011, 07:40:39 PM
badbehavior_httpbl_key
badbehavior_httpbl_threat
badbehavior_httpbl_maxage

httbl_key is obvious, but the other two values aren't quite so obvious? The httpBL mod has two threat values and three values that might correspond to maxage, or maybe your values mean something completely different?

BB has only one for each.  You exceed the set point(s) and the visitor will get blocked.

• badbehavior_httpbl_key:  http:BL Access Key obtained from Project Honey Pot (http://www.projecthoneypot.org/)
• badbehavior_httpbl_threat:   Minimum Threat Level (25 is recommended)
• badbehavior_httpbl_maxage: Maximum Age of Data (30 is recommended)

This is the Honey Pot Configuration for literally hundreds of thousands of BB installations throughout the world.  At this time I have no intension of expanding this feature beyond it's default.
::)

Hi buchs,

Thanks for this great mod.

I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

ID: 90
IP: <IP reported correctly>
DATE: 2011-02-25 11:59:09
METHOD: GET
URI: /forum/
PROTOCOL: HTTP/1.1
HEADERS: GET /forum/ HTTP/1.1 Connection: Keep-Alive, keep-alive Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,image/png,*/*;q=0.5 Accept-Charset: iso-8859-1,utf-8;q=0.7,*;q=0.7 Accept-Language: en;q=1.0,en;q=0.5 Cookie: <removed>; <removed>; has_js=1; PHPSESSID=<removed>; OAID=<removed> Cookie2: $Version=1 X-Nokia-MusicShop-Version: 11.1014.15 X-Nokia-MusicShop-Bearer: GPRS/3G x-wap-profile: "http://nds1.nds.nokia.com/uaprof/NN97-4r100-3G.xml" Referer: http://<removed>.com/forum/ Accept-Encoding: gzip, deflate, x-gzip, identity; q=0.9 Host: <removed>.com X-Forwarded-For: 10.12.159.128 Via: 192.168.1.79:8080 (TeleDNA 2.0) User-Agent: Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-4/12.0.110; Profile/MIDP-2.1 Configuration/CLDC-1.1) AppleWebKit/525 (KHTML, like Gecko) BrowserNG/7.1.4 X-Network-Info: UDP, 10.12.159.128 Called-Station-Id: <removed> X-Mms-SgsnIp: <removed> X-Mms-SgsnMccMnc: 40473 X-Mms-Prepaid-Flag: N X-MSISDN: <removed>
AGENT: Mozilla%2F5.0%20%28SymbianOS%2F9.4%3B%20Series60%2F5.0%20NokiaN97-4%2F12.0.110%3B%20Profile%2FMIDP-2.1%20Configuration%2FCLDC-1.1%29%20AppleWebKit%2F525%20%28KHTML%2C%20like%20Gecko%29%20BrowserNG%2F7.1.4
ENTITY:
KEY: a52f0448
DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Can you please help? Thanks.

hmmm...   these errors just started showing up today:


2: in_array() [<a href='function.in-array'>function.in-array</a>]: Wrong datatype for second argument
File: /....../Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 27

Quote from: Glasso on February 25, 2011, 02:20:45 AM

Code Select Expand

[quote author=Glasso link=topic=375980.msg2967788#msg2967788 date=1298618445]
I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Bad Behavior it's self is extremely conservative, is being used by a large volume of web sites, the package has strong support and does everything possible to prevent blocking valid users.

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to "fix it yourself" for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key "a52f0448". This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. The core author provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior weblog entr (http://bad-behavior.ioerror.us/2007/12/07/what-to-do-when-bad-behavior-blocks-you-or-your-friends-2/)y on the topic.

Quote from: Kindred on February 25, 2011, 11:09:02 AM
hmmm...   these errors just started showing up today:

2: in_array() [<a href='function.in-array'>function.in-array</a>]: Wrong datatype for second argument
File: /....../Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 27

I need to think about this some...

Kindred.  Try the attached and let me know if it solves the issue?

immediate errors

8: Undefined index: badbehavior_roundtripdns
File: /home/fortyk/public_html/community/Sources/bad-behavior/bad-behavior/roundtripdns.inc.php
Line: 25

That line did not change from the last version (Bad Behavior 1.4.1).  Version 1.4.1 includes the new 'badbehavior_roundtripdns' modsetting.  So if you do not have the latest version please update.  If you upgraded please go to the setting page and hit save so that the modsettings will get saved in to the mysql database.

The attached version should eliminate that in the future.  But it will not do anything unless the modsetting exists.

You may see an error burp if someone is online during the installation.  This happens when the file changes while it is being used.

Quote from: butchs on February 25, 2011, 08:41:41 PM

Quote from: Glasso on February 25, 2011, 02:20:45 AM

Code Select Expand

[quote author=Glasso link=topic=375980.msg2967788#msg2967788 date=1298618445]
I have bad behaviour installed but most connections from phones are bloceked. Here is more detail:

DENIED REASON: Header 'Connection' contains invalid values
EXPLANATION: An invalid request was received. This may be caused by a malfunctioning proxy server or browser privacy software. If you are using a proxy server, bypass the proxy server or contact your proxy server administrator.
ERROR: 400

Bad Behavior it's self is extremely conservative, is being used by a large volume of web sites, the package has strong support and does everything possible to prevent blocking valid users.

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to "fix it yourself" for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key "a52f0448". This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. The core author provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior weblog entr (http://bad-behavior.ioerror.us/2007/12/07/what-to-do-when-bad-behavior-blocks-you-or-your-friends-2/)y on the topic.

Hi butchs,

I understand; I have sent you the logs by email. Appreciate your help, thanks.

No problem but, the core author is Michael Hampton.  He will investigate your request and make adjustments or suggestions as required based off of your feedback and the thousands of others he gets every day.  Then I will incorporate those changes into the SMF port.
O:)

Quote from: butchs on February 26, 2011, 01:31:08 PM
No problem but, the core author is Michael Hampton.  He will investigate your request and make adjustments or suggestions as required based off of your feedback and the thousands of others he gets every day.  Then I will incorporate those changes into the SMF port.
O:)

Man, Michael is quick! He confirmed there is indeed an issue with what header the Nokia phone/service provider is sending and that BB is working as expected.

Butchs, if you don't mind taking a look at the Forum Firewall log with a bunch of 'keep-alive's in the IP field, please PM me your email id.

Many thanks.

Quote from: Glasso on February 26, 2011, 02:14:56 PM
Butchs, if you don't mind taking a look at the Forum Firewall log with a bunch of 'keep-alive's in the IP field, please PM me your email id.

What happened in BB is not the same as FF.  The tests are not the same.  BB does not look at the ip address field.  It checks the "Connection " where Keep-alive are supposed to reside.  When that field is in error it is blocked.

Now Michael has been working on the Core for over 5 years and the core is so widely used that he actually has the umph to have Nokia fix the header or face being blocked from many sites.

This is why BB is the choice for spambot protection by many sites.

New update posted today.  Changes are minor, only upgrade if you are experiencing errors in your log.
  :D

SMF 2 RC5
Bad Behavior 1.4.2


What should the permission be for core.inc.php? Mine is set 666. Is that correct?





2: require_once(/Sources/bad-behavior/bad-behavior/banned.inc.php) [<a href='function.require-once'>function.require-once</a>]: failed to open stream: Permission denied

File: /Sources/bad-behavior/bad-behavior/core.inc.php (http://www.fivearts.net/index.php?action=admin;area=logs;sa=errorlog;file=L2hvbWUvZml2ZWFydHMvcHVibGljX2h0bWwvU291cmNlcy9iYWQtYmVoYXZpb3IvYmFkLWJlaGF2aW9yL2NvcmUuaW5jLnBocA==;line=19)
Line: 19

Do not change the permission of banned.inc.php.  Ignore the change request.

The reason is the method I have to install the mod, first I install the BB  package then write over the banned.inc.php file.  I checked my file in cpanel and it's permissions were fine so no changes are required.

The read me has red letters that tell you that when you install the mod with 2.0x you may get a permission error.  If you listen to SMF and change the permission, I have found exactly what that user has posted.  So unless his server acts differently than my test server uninstall the mod, reinstall it and do not change the permissions and it should work.

Here is the readme text:
During installation of SMF 2.0x, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!

If not then you find that you need to change the permission do it in cpanel.  Make it the same as all the other files in the BB folder.

Duuh, if you do not follow the instructions in the read me during installation then you risk having a problem after installation.

Each server may have a different set of default permissions.  Sites such as host gator do not allow you to use 666 or 777 because they are world writeable.  If you do not know what works on your server contact your host and ask them what permission to use.

Besides, I run a gentile Web Site and as such do not have files set with the Devils Permissions.   O:)

The following was taken fro the Forum Firewall thread:

Quote from: Glasso on March 05, 2011, 10:43:35 AM
Butchs, this is causing some genuine googlebot requests to be blocked as I see in my webmaster logs. I can send you some trail that I had with Michael where he thought roundtripdns is not fully reliable, if you believe it is worthwhile to go deeper.

A statement by Michael may not apply with the SMF version.  My version has improved DNS tests and has been running on my site for well over 6 months with ZERO issues.  Needless to say that it is not 100%, fake bots can still get past.  As per the help icon "?" and stated before my roundtrip works fine for some sites but if your host is using Ubuntu 10.x it may not work.  In that case uncheck "Search Engine DNS".

The following is taken from the core website:

Quote from: bad-behavior.ioerror.usGoogle operates a proxy server for "feature phones" (dumb mobile phones; perhaps should be called feature limited) with limited Web browsers which reformats web pages into a simpler format for viewing on such phones. While it is now rarely used, requests from this proxy server, known as Google Wireless Transcoder, were being treated as search engine requests (and denied for not being a search engine). This issue has been fixed.

Please note the rare statement.  I personally have not seen the google wireless bot get blocked.  So unless you have a popular website with over 400 visitors a day there is the chance that the bot you are seeing may or may not be a fake.  This is the internet and anything can be spoofed.  Do you think the bad guys will never try to edit google?    ::)

I do not know what to tell you, nothing is perfect.  BB runs on many sites that get thousands of blocked visitors a day.  He uses his best judgement.  When the core author sees a major problem he will upgrade and this mod will follow.

Quote from: butchs on March 05, 2011, 02:16:45 PM
The following was taken fro the Forum Firewall thread:

Quote from: Glasso on March 05, 2011, 10:43:35 AM
Butchs, this is causing some genuine googlebot requests to be blocked as I see in my webmaster logs. I can send you some trail that I had with Michael where he thought roundtripdns is not fully reliable, if you believe it is worthwhile to go deeper.

A statement by Michael may not apply with the SMF version.  My version has improved DNS tests and has been running on my site for well over 6 months with ZERO issues.  Needless to say that it is not 100%, fake bots can still get past.  As per the help icon "?" and stated before my roundtrip works fine for some sites but if your host is using Ubuntu 10.x it may not work.  In that case uncheck "Search Engine DNS".

Butchs, I am providing my feedback to you because I love your mod and appreciate your efforts. I was thinking further inputs will help you make it watertight for all of us, but I will step back if you see this as fault finding! I have stepped on enough peoples' toes today already. ;)

I looked for the "?" before I made any posts but could not find any for BB (the way I see for FF, for example). Not sure if it is just an issue for me - please see attachments 1 & 2.

My server is not Ubuntu, I have disabled Search DNS today anyway.

Quote from: butchs on March 05, 2011, 02:16:45 PM
Please note the rare statement.  I personally have not seen the google wireless bot get blocked.  So unless you have a popular website with over 400 visitors a day there is the chance that the bot you are seeing may or may not be a fake.  This is the internet and anything can be spoofed.  Do you think the bad guys will never try to edit google?    ::)

I would not contest anything you say since you are the expert here, I can only give you an example why I thought a genuine request was blocked and you can take a call. Please see attachments 3 & 4, where I tried to pick a BB block and find the corresponding line in google webmaster log - I may be off the mark in trying to correlate thus.

Quote from: butchs on March 05, 2011, 02:16:45 PM
I do not know what to tell you, nothing is perfect.  BB runs on many sites that get thousands of blocked visitors a day.  He uses his best judgement.  When the core author sees a major problem he will upgrade and this mod will follow.

Agreed. I see you as the two architects working hand in hand to implement this great tool, so I do not want to risk misrepresenting anything here. I rest my case here and thank you for your time and support.  8)

Quote from: Glasso on March 05, 2011, 03:12:02 PM
I have disabled Search DNS today anyway.

I have known about this for a while and was notified of the same issue many posts ago.  This feature is an option because it will not work for everybody.  There is no way for me to tell where it will and will not work.  It seems that the test did not work for you at that time.  In your case I would leave the "Search Engine DNS" option disabled.  This is also why it is disabled when the mod is installed.

This mod blocks RSS view in iPhone. How to fix this problem?

I answered that one over at SMFhelper.

Hi butchs

Is there an update/news on the fail like this:

Database Failure: No database selected
Fil: /home/XXX/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Linie: 74

/Jakob

No one else is experiencing that error.  It looks like the mod did not install all the way and the DB was not installed.  Try installing again.  If you went manual you need to run "install_db.php".

Quote from: Jesna on March 11, 2011, 11:30:20 AM
Hi butchs

Is there an update/news on the fail like this:

Code Select Expand

Database Failure: No database selected
Fil: /home/XXX/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Linie: 74

/Jakob

I am getting this error as well on my forum, I did not do a manual install, but attempting to run install_db.php gives this message:

No database selected
File: ..../install_db.php
Line: 263

For some reason your DB is not set on your site.  You should check your "Settings.php" file and confirm the DB is correct.  Try running Repair Settings.php (http://download.simplemachines.org/?tools) and see if you have an issue.  Then try to completely uninstall the mod and reinstall it.

the database is just fine the mod seems to work just fine as well, other then that error message.

All I know is that there was a problem with the old SMF 1.1.x (possibly beta) version where it did not use the correct $db_prefix.  This was fixed in a newer version.

If you completely uninstall the mod including deleting the DB or the "smf_settings: badbehavior_log_table" entry in phpmyadmin and reinstall the latest version that old version bug should go away.

Other than that, any thing could be causing it, including another mod/ portal, I will need to be able to somehow duplicate the error or see it in person in order to tell you what is going on.  Try the above and if it does not go away then please provide  your SMF version and a list of all your mods/ portals.

my forum is not that old to have that problem, it started with 1.1.11 and upgraded to 1.1.12-1.1.13.

currently installed mods 1. Aeva Media 1.4  [ Uninstall ] [ List Files ] [ Delete ]
2. Internal_Links_Use_Same_Window 1.2  [ Uninstall ] [ List Files ] [ Delete ]
3. Easy Edit Meta Data 1.1  [ Uninstall ] [ List Files ] [ Delete ]
4. Bookmarks 2.3 [ Apply Mod ] [ List Files ] [ Delete ]
5. Custom Profile Field Mod 3.20  [ Uninstall ] [ List Files ] [ Delete ]
6. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]
7. Version Emulate Dropdown 1.1  [ Uninstall ] [ List Files ] [ Delete ]
8. SMF 1.0.20 / 1.1.12 Update 1.0  [ Uninstall ] [ List Files ] [ Delete ]
9. Who Voted What? 1.1.3  [ List Files ] [ Delete ]
10. DisableTemplateEval 1.2  [ Uninstall ] [ List Files ] [ Delete ]
11. Bad Behavior mod 1.4.2  [ Uninstall ] [ List Files ] [ Delete ]
12. Allow Access while in Maintenance Mode 1.1  [ Uninstall ] [ List Files ] [ Delete ]
13. Forum Firewall 1.0.8  [ Uninstall ] [ List Files ] [ Delete ]
14. Ad Managment 2.3.6.1  [ Uninstall ] [ List Files ] [ Delete ]
15. Downloads System 1.3.4.2  [ Uninstall ] [ List Files ] [ Delete ]
16. Bot Buster 1.1  [ Uninstall ] [ List Files ] [ Delete ]
17. httpBL 2.5.1  [ Uninstall ] [ List Files ] [ Delete ]
18. Login Detector 1.0  [ Uninstall ] [ List Files ] [ Delete ]
19. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]
20. SMF 1.0.21 / 1.1.13 Update 1.0  [ List Files ] [ Delete ]

in the error message the file being called is index.php.

Quote from: Illori on March 13, 2011, 08:28:40 PM
my forum is not that old to have that problem, it started with 1.1.11 and upgraded to 1.1.12-1.1.13.

I can not help you if you do not work with me and try what I ask.

Why do you have two of there "SMF 1.0.21 / 1.1.13 Update   1.0     [ List Files ] [ Delete ]"?  This does not look right...

the update was applied one time, but for some reason the package shows up 2 times no idea why. since the rest of the forum works fine i am not going to play with checking settings.

Then I can not help you.

well then this mod is useless to have on my forum as i will get no support from the author. there goes 2 of the mods off my forum.

Do you think I have ESP or something?  How could I help you when you will not work with me?

Honestly, I created the mods for my site.  They worked so well I decided to share them.  If you do not want to use them so be it...

In reply 158 I gave him instructions.

Quote from: butchs on March 13, 2011, 08:24:57 PM
If you completely uninstall the mod including deleting the DB or the "smf_settings: badbehavior_log_table" entry in phpmyadmin and reinstall the latest version that old version bug should go away.

He refused.  Therefore, I can not help him.

first off you gave HER instructions and i replied with the needed information, you said the prefix issue was with an OLD version of smf which i dont run and never have on this site, I gave you a list of my mods that are installed and you refuse to look further into the issue. I have wasted enough of my time in this thread.

If you want to be a her then show your sex.  I do not have ESP.   :(

I was talking about the mod.  Read the posts again.

First off, thanks Simple Machines for an awesome forum software. Easy to use, easy to maintain and easy to admin. Second, thanks butchs for not only the amount of time you've put into the mod, but also the amount of time you've spent supporting it.

I've spent a few hours (well more than that actually, but don't want to admit how much!) trying to get the mod installed and working. I'm on .13 and was able to successfully upload the package, apply the mod and install. I get the "settings" page, so it *appears* as though everything's there - but when I add the test string to my UA, I don't get blocked and no matter what I've tried I don't get the string of text for BB when I view source. I've tried from a few different machines with various OS's as well as a few different IP's (from work as well as from home).

As I read through this (or possibly another) thread, I remember seeing that there are two parts to installing this - the mod itself and then an install; however, I can't seem to find the "install" part - the page linked to in the first post has the mod (which installs fine), but there's no separate install that I've been able to find.

What am I missing?

Thank you.

That is good.  If you are logged in as the ADmin the test string will not work.  Log out and try it, then it will work.

This is done to prevent you from being blocked.

Thanks for the quick reply! I did try it as admin, as a normal user and as guest, testing with and without the UA string set - I still see nothing. In fact, I don't even see the BB text in the HTML source, no matter what I've tried. It seems like I'm missing a piece somewhere. Is there only supposed to be the one download or should there be both a "mod" and "install" package?

What information can I provide in order to help with this?

If you have a UTF8 sight you will need to copy the "Themes/default/languages/BadBehavior.english.php" and rename the copy "BadBehavior.english-utf8.php".  Reload your browser.  Then you can see the Bad Behavior menu in the admin section below "Configuration/Themes and Layout".  You will need to go there and turn on (enable) the mod in order to start to protecting your site.

The mod is now only 1 part.  A second part is not required.

To test the mod you will need to log out of your forum and replace your UA with "Bad Behavior Test".

Success! Well, sorta... I found that the mod's "status" text in the footer only appears with the default theme (my forum's default theme isn't the SMF default). Your point about renaming the BB.english.php file clued me in - that file is located in the ./Themes/default/... directory, so I reverted back to the default theme for my test user account and started seeing all the things I was missing (footer, BB message in HTML source, etc.).

Thanks again!

Even though it was dumb luck on my part I am glad I could help you.  ;)

New version was released today.  No code changes were made to the English version.  Support for Spanish has been added.

Thanks to xaquin this is the only release of Bad behavior that completely supports spanish-es, spanish-es-utf8 and spanish-latin languages.

The SMF mod is in Spanish as are the help icons and the BB core has been translated.
:)

New version:

Added project honey pot to the admin panel.   This was hidden for some time.
Improved spanish loading.  The last version did not load all the files.
Added an option to block blank UA's.

Thanks for the new version 1.4.4, how to update from v1.4.2?

Uninstall the old version.  You can keep the database.  Delete the old version.  Then download and install the new version.

OK, thanks for the reply.

You are welcome. :)

Installed after being harassed by spam bots yesterday. But I'm a rookie and have no idea what you mean by this : To test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist  

google is your friend
http://johnbokma.com/mexit/2004/04/24/changinguseragent.html

will try that, thanks 8)

You need to log out to test.   Or you can wait.  You should see something on the "DENIED ENTRIES LOG" long in a day or two.

Ok I'll wait a bit because that testing with UA goes beyond me  :-\

Nice mod, been using it 24 hours now and its catching a nice few spam bots :)

Sorry, maybe not the place to discuss this, but don't know where to talk about it elsewhere :-[

I have a small  forum, never thought of setting the registration to "wait for approval by admin" did that after the spam and now I have caught one unknown member with the same IP address as the spam bot. So that may be why the mod didn't log a spam bot yet. Can those bots bypass that "approval by me"?

You can drastically improve protection by registering with project honeypot (http://www.projecthoneypot.org/) and entering a "Access Key", Threat Level and age.  Click on the "?" for more info.

Think I managed that, but caught one more like this... Thanks for the info
I looks like they can't bypass the approval by admin?

Besides CrawlProtect, Forum Firewall and Bad behavior I use Stop Spammer and Avatar Verification with over 100 images.  This has proven to be highly effective in stopping spam.

After upgrade to 1.4.5 cannot open key on log.

SMF 2.0RC4

mods

1.   RSS Feed Icon    1.1
2.   SMF 2.0 RC4 Security Patch    1.0
3.   Simple Audio Video Embedder    1.1.1
4.   Separated Birthdays from Events    1.1.6     
5.   Facebook_Like v.1.4   
6.   Login Security    1.0.2.2     
7.   AvatarSelect    1.2.1     
8.   Ultimate Profile    0.9.1     
9.   No Reply Emails    1.3.7 
10.   LMGTFY BBcode    3.7 
11.   Bad Behavior mod    1.4.5 
12.   PNG Message Icons    1.3.1 
13.   Pretty URLs    1.0RC5 
14.   Global Headers Footers    2.0 
15.   CSS Message Boxes    1.1     
16.   Advanced Reputation System    1.8.3 
17.   New Topic in Seperate Color    1.1 
18.   Dynamic_Memberlist    2.0.5     
19.   Users Online Today    1.5.6     
20.   last login    2.5     
21.   Wireless/RSS amount displayed   1.1.0
22.   Happy Birthday    0.2.2     
23.   Password Strength Meter    1.1
24.   Anti-Spam Links    1.0.1     
25.   ENotify    2.0     
26.   Project Snow 1.1   
27.   Default Avatar

I saw that this morning and made a change.  I thought no one grabbed a copy.  Try to re-download a fresh copy and install.


Any 2.0 installations that uploaded before this post was made will need to re-upload.

Thank you for all your time you spent creating and supporting this mod  ;D. I am new to SMF and making my around installing different mods (this one too).
I am running 2.0RC5 with Simple Portal.

1. What files should I copy the Bad Behavior image code to ?
2. Do have to sign-up to HoneyPot to get the access key for my site?
3. If # 2 is true, will I get a HoneyPot link for my settings?
4. Is it advisable to block empty user Agents if paypal is not involved at our site yet?

Thanks again.

1.  None just install the mod.
2.  Yes.
3.   Yes you can.
4.  Not recommended but a few do.

Thanks, where are the images suppose to be displayed?
I don't see any images in the footer. If that is where they are displayed.

You mean something you tried to post?  I have no clue.

Quote

Code: [Select]

<p><a href="http://www.bad-behavior.ioerror.us/">
<img src="http://www.bad-behavior.ioerror.us/images/bad-behavior-80x15.png"
alt="Bad Behavior" height="15" width="80" /></a></p>>

No, this image from the OP.

You need to put the image on your your site and adjust the image link.

Core update to 2.1.12.  No mod changes.

What's new:

QuoteGoogle is now operating a new IP address range in China, from which it is crawling some Web requests. Interestingly, it is crawling all countries from this Chinese address range. Bad Behavior is now aware of this address range and will no longer block requests from Google which originate in China.

Sorry but i only see one rar file !
Bad Behavior 1.4.6

I do not understand.  The mod does not have a rar file.  It is compressed in winzip.  This is the standard for SMF.  The mod now only needs the one zip file.

I think I understand what he meant. Looking at the mod download page, the only 2 files listed is  Bad_Behavior_1.4.6.zip and  BB_Language.zip.

Oh, I missed that too. There is a difference between the core and the mod itself. He probably did not see that. 

So where is the link for the corefile then?
Sorry but im kind off busy with that hole honey pot stuff,but really...i dunno where too put the links intoo?
do they mean in the index.template file?and where too put it?just copy and paste somewhere?

No.  I explained this before.  The mod is not a 2 part mod anymore.  Version 1.4.x includes both the core and the mod.  The language file is only for translating the mod to another language.  If you want the mod and core install the latest version of the mod to have both.

Want to uninstall Bad Behavior v1.4.2 and install v1.4.6, regrettably no uninstall button available, uninstaller file is missing (anyway, I assume), only the 'list files' and 'delete' buttons are visible. What to do?

The uninstall file is present in the package.  First you have to uninstall the old version before downloading the new version.  Whatever you do, do  not install the new version until after you uninstall the old version.  If you do you will have to manually edit your SMF files.

I guess there could be the chance that the "Bad_Behavior_1.4.2.zip" in your Package directory became corrupt via your host?  If you have a copy on your local drive the try using ftp to replace the "Bad_Behavior_1.4.2.zip" in your package directory.  If you do not have a copy plz PM me you email.

Otherwise I think you may have a package directory issue that may be something SMF support will be better at resolving.

Quote from: butchs on April 17, 2011, 07:48:30 AM
The uninstall file is present in the package.  First you have to uninstall the old version before downloading the new version.  Whatever you do, do  not install the new version until after you uninstall the old version.  If you do you will have to manually edit your SMF files.

I guess there could be the chance that the "Bad_Behavior_1.4.2.zip" in your Package directory became corrupt via your host?  If you have a copy on your local drive the try using ftp to replace the "Bad_Behavior_1.4.2.zip" in your package directory.  If you do not have a copy plz PM me you email.

Performed as suggested (replaced Bad_Behavior_1.4.2.zip in the package directory by a copy on my PC via ftp) but the uninstall button is still missing. What's the name of the uninstall file in the package?

package-info.xml contains the uninstall script.  This link (http://www.simplemachines.org/community/index.php?topic=408778.msg2848033#msg2848033) may be of interest.

Assume I found the cause and the fix, will report back atm I have finished successfully the uninstall v1.4.2

Cause of the prob: installed the mod on a SMF 2 version older than 2.0 RC2

During install v1.4.2 I encountered no probs, I emulated SMF 2.0 RC2 and the mod installed without any protest. Didn't expected that for uninstall it was also demanded to emulate SMF 2.0 RC2, atm I emulated to RC2 the uninstall button appeared.  :)

Some questions:

Search Engine DNS: what is advisable, activating or not?
Cache Duration: the time delay can be set between 0 and 99 seconds, zero disables this feature, standard is the value zero. Is it advisable to set a time delay, and if yes, what value at least to be effective?

Interesting...

Quote from: Smog on April 17, 2011, 10:50:34 AM
Search Engine DNS: what is advisable, activating or not?

I use it and it works well for my site.  I have been using it for 6 months now.  It blocks a fake google and etc every now and then.  But some servers such as Ubuntu have issues.  If you try it, I suggest you monitor it for a few days to make sure no regular members get blocked.

Quote from: Smog on April 17, 2011, 10:50:34 AM
Cache Duration: the time delay can be set between 0 and 99 seconds, zero disables this feature, standard is the value zero. Is it advisable to set a time delay, and if yes, what value at least to be effective?

This feature was designed to reduce the amount of checks the mod makes when testing a user for large forums.  For example, if a bad guy hits your site BB will test it the first time.  If the bad guy is blocked the mod will forgo testing and block the bad guy the remaining duration of the cache set point.  The same is true if a regular member comes to the forum.  The member will not be tested again the duration of the cache set point.

Typically you like to set this to half the average duration of a bad bot visit but in most cases no more than 20 or 30 seconds.  As a minimum you will like to test a bot two times a visit.  Some people prefer three to four times.

If you have cpanel or some other way of tracking the last 100 users, you can look at visitor ip records.  Take the duration of the average visit and divide by at least two.  If you can not do this then 2-8 seconds can be a good starting point.

Why use this feature?  Well, a bad bot can hit you once or twice every second and eat up your bandwidth and/ or processor speed.  This feature can make your site faster because it will send the bots packing before SMF fully loads (ie page images/ icons).

The reason it is not recommended is because Bad behavior is extremely fast in the first place.  Bad behavior's core author has informed me that the package has been installed on some large CMS sites and it sill completes all tests in less than 10 milliseconds.  If you look at the page source (just below the title when viewing the main index) you will see the speed of this mod at work:  <!-- Bad Behavior 2.1.12 run time: 3.025 ms -->.

However, if you are using the Project Honey Pot portion and/ or enable the Search Engine DNS features or have a large web site I will recommend using a little cache.

The reason for using cache on a large forum is obvious so I will not get into it.  The other two are less obvious.  The reason I recommend cache for them because they both look up information at a remote site.  Some say this can slow things down.  So by using cache you reduce the amount of remote lookups your site makes.
8)

Thanks for the comprehensive reply, appreciated. I also appreciate all the time and efforts you invest in this mod, even more because the mod work extremely well.

Malicious or spam related activities are a serious problem and have heavy, severe impact on sites and their legal visitors. Problems related to mentioned activities are immense and on the rise, OTOH there are several solutions to limit or even to cease malicious activities on sites. Bad Behavior is one of the solutions and I must say, till yet the most effective solution, there is no doubt about that fact. Using Bad Behavior together with a http:BL Access Key the mod work deathly effective and block almost all malicious site activities, hence Bad Behavior is a must have tool for site owners taking their job serious: protecting their site as well customers and legal visitors.

Also important to mention: till yet no legal visitor, search engines included, was blocked, we shouldn't underestimate the importance of this.

I'm very pleased about the mod, and will unconditionally recommend it to fellow site owners.

Kind regards,

Smokey

You are welcome.

Hi,

Does the 'local timezone' refer to my personal timezone, or the zone where the server is located?

What is the purpose of this setting?

Thanks.

Oh, and where do I have put the .htaccess file? Is the site root, or the BB root?

Quote from: butchs on April 21, 2010, 10:05:00 PM
The mod does not give out your email as a normal email.  If your email is [email protected] it shows admin at yoursite.com.  A human/ spammer will have to correct and type it in order to be able to send you a message.  So the chances are low that you will get spammed.

This is included so that regular users can contact you for access.  For example, someone you know logs in and gets ERROR 403.  They can then use this error to send you a message and get placed on the whitelsit by you.  If you did not give them a method to contact you, they will never be able to log in.

The email listed is from the "Webmaster Email Address" listed in "admin -> server settings -> general -> Webmaster Email Address".  It is not recommended but, if you do not want your email address showing up leave the above setting blank.

Hello Butchs,

I've never looked into it, but I assume that spammers have systems in place to automatically remove simple obfuscation from harvested e-mail addresses. This must be a trivial matter compared to cracking anti-spam measures such as reCaptcha, etc. So, I will be changing this behaviour to protect my website from possible spam. I think it would be better to instead provide an admin setting so that we might specify a URL. The destination webpage could be a contact form (my intention), or just a set of instructions for how the visitor might fix the problem (in my view, not the best solution).

Quote from: Col on April 18, 2011, 08:56:10 PM
Does the 'local timezone' refer to my personal timezone, or the zone where the server is located?

What is the purpose of this setting?

Where do I put htaccess?

In most cases you will not need that setting.  You only need to worry about it if you get an error.

An error will look like this:

QuoteStrict Standards: bb2_install() [function.bb2-install]: It is not safe to rely on the system's timezone settings. Please use the date.timezone setting, the TZ environment variable or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/New_York' for 'EDT/-4.0/DST' instead in .../BadBehavior-SMF.php on line 202

Notice: Undefined index: logging in .../BadBehavior-SMF.php on line 202

If you get it ask your host for assistance.  Some times they do it in the php.ini file.  It depends on the provider.  If so, it will be your home time zone.

Quote from: Col on April 19, 2011, 06:37:07 PM
I've never looked into it, but I assume that spammers have systems in place to automatically remove simple obfuscation from harvested e-mail addresses...

I have looked into it and my method is rather unique.  It is even different than the BB core.  I am not going to tell you what I do... Rest assured at publishing time my methods were not used anywhere else on the net.  I only write code for SMF so it is way too much trouble for a bot to make code just to harvest email addresses from my mods.  Caputa is much easier since it is more common.

Edit the following to make it even harder:
Take "BadBehavior.english.php" and change $txt['badbehavior_theadmin'], $txt['badbehavior_nospam'], $txt['badbehavior_dot'] and $txt['badbehavior_dash'] to something unique.

You are safe with the SMF BB mod.

Quote from: Col on April 19, 2011, 06:37:07 PMThe destination webpage could be a contact form (my intention), or just a set of instructions for how the visitor might fix the problem (in my view, not the best solution).

You miss the point of bad behavior.  BB provides a link to the BB home address and a support key.  So the support is dealt remotely by the BB home site or by you.  This is the power of the mod.  Literally millions of other sites use the same support system.  The following is taken from the BB site:

In extremely rare circumstances, Bad Behavior may block actual human visitors. Bad Behavior was designed to target robots, not people. If this happens, the profile presented by your browser matched that seen from actual malicious robots. In some cases, this is caused by over-aggressive personal firewall/browser privacy software. In other cases, this is caused by improperly configured Web proxy server software.

First, make a note of the technical support key and e-mail address shown on the error page. Then click the link to "fix it yourself" for suggestions on how you may be able to resolve the problem.

If you continue to have trouble, contact the e-mail address on the error page and be sure to provide the technical support key. This will allow the site administrator to tell you what you need to do to resolve the problem.

If you are the site administrator receiving a trouble report from a user, contact me and provide the technical support key and a copy of the logs which Bad Behavior stores in the database showing the IP address which was blocked. I will provide further assistance until the trouble is resolved.

For more information on how to diagnose a Bad Behavior blocking problem, see the Bad Behavior (http://bad-behavior.ioerror.us/) weblog entry on the topic.

Hi,

Thank you for your reply, Butchs.

I had someone else try entering my test forum using Modify Headers - I was reliant upon their feedback. They had a problem with a malconfigured email client, so their email program did not start when they clicked the contact email link provided. I had them instead right-click the email link to provide me with address - it was address listed for Webmaster Email Address in Server Settings, but with some no-spam obfuscation. This is where I'm confused by your reply - I thought this unobfuscated address easily discernible.

I am also confused by the practical difference between providing a direct email link and a link to a contact page, which generates an email to me, without ever revealing even an obfuscated version of my address. Reading your reply, I'm sure I must be missing something - but what is it!?

I don't properly understand how BB works (I don't really need to), but I like the idea of addressing this spam problem at a more fundamental level, without the need to resort to checking content, IP address, etc. I have my own (human) system in place, to act as a final check, before the first post of the new member ever makes it to the open forum (few make it this far). Any member of the team can approve the account by approving their first post, so there is usually little delay to genuine members. I do not anticipate needing Project Honeypot that you have usefully integrated into BB, as I never have spam reaching my forum boards. But I do suffer from an inordinate number of spam accounts (swamping the membership list), and bandwidth being eaten up by their attempts to join up and post at the forum. I anticipate substantial bandwidth savings using BB.

Again, thank you,

Colin.

Only with the stand alone core but this is not the core!  This is the SMF Version which is much more secure...

You need to look for yourself and not rely on people who are trying to sell you something.  There are way too many people who are into smoke and mirrors who make up things to sell something.  Lame...

Take the troll I finally rid my mod posts from.  He claimed to be trying to help but if you read his posts they were nothing but self promotion.  All along he simply wanted to copy my ideas.  Glad the posts were deleted...

Edited because I have been mean to my troll so I decided to chill out and let things be.  Sorry...

The truth of the matter is that bots look at source code.  If you want to see what the warning page looks like to a bot look at it in your browsers view source mode.  Your webmasters email will be different on every page load.

Even if you click on your email address you will get an address as I described with the "BadBehavior.english.php" edits.  Basically the bot will have to edit the email to make it usable.  If you edit "BadBehavior.english.php" yourself, as advised, it will be even more unique.  Which is great for stopping spam.

There is no such thing as a webmaster "direct email link" or "unobfuscated address" with this mod unless you make it that way.   The mod only provides an obfuscated address that the emailer has to figure out.  They are usually easily discernible to experienced internet users.  But as stated before you can edit them to whatever you desire.

Bots are automated scripts when you throw something at them they never encountered they fail!

Nevertheless, I do not understand your concerns?  As stated in my last post the member has the ability to  "fix it yourself" through the vast Bad Behavior network.  So your webmaster email is the last resort not the first or only resort.  Please re-read my last post...  Then you will realize it is the last resort.

Now this mod has another feature that BB core does not have and that is the ability to place a Project Honey Pot - Honey Pot or a QuickLink in the Warning Page.  What this means if a bot went nuts and clicked on all the links in the warning page it will get penalized with an increased Project Honey Pot warning level.  Not only a deterrent but a no win situation for the bot.

So when it comes to webmaster link security rest assured, I have all the bases covered and will up the technology if and/ or when required.   8)

Quote from: butchs on April 20, 2011, 09:11:19 PM
Only with the stand alone core but this is not the core!  This is the SMF Version which is much more secure...

You need to look for yourself and not rely on people who are trying to sell you something.  There are way too many people who are into smoke and mirrors who make up things to sell something.  Lame...

Take the troll I finally rid my mod posts from.  He claimed to be trying to help but if you read his posts they were nothing but self promotion.  All along he simply wanted to copy my ideas.  Glad the posts were deleted...

Hello Butchs,

Thank you for the very fulsome reply.

No one is trying to sell me anything.

QuoteThe truth of the matter is that bots look at source code.  If you want to see what the warning page looks like to a bot look at it in your browsers view source mode.  Your webmasters email will be different on every page load.

Even if you click on your email address you will get an address as I described with the "BadBehavior.english.php" edits.  Basically the bot will have to edit the email to make it usable.  If you edit "BadBehavior.english.php" yourself, as advised, it will be even more unique.  Which is great for stopping spam.

I tried it out for myslef, after I was pretty confident I would not lock myself out of the forum. I had a look at the source - I'll take your word for it that a bot is highly unlikely to be able to make sense of what looks to me (as a non-coder) to be some sort bastardisation of html numbers and unicode.

Those that fail the BB requirements are presented with the following:

QuoteError 403 We're sorry, but we could not fulfill your request for /forum2/ on this server.
You do not have permission to access this server.
Your technical support key is: xxxx-xxxx-xxxx-xxxx
You can use this key to [link]fix this problem yourself[/link]
If you are unable to fix the problem yourself, please contact the WEBMASTER and be sure to provide the technical support key shown above

My forum has some of the least technically able, and most cognitively impaired people on the planet. I do not like the idea of them trying to work out how to edit the displayed email address to remove all the "+nospam-nospam" obfuscation. Even if I edited the message, and changed the obfuscation words, many of them would have hard time with this.

QuoteThere is no such thing as a webmaster "direct email link" or "unobfuscated address" with this mod unless you make it that way.   The mod only provides an obfuscated address that the emailer has to figure out.  They are usually easily discernible to experienced internet users.  But as stated before you can edit them to whatever you desire.

Bots are automated scripts when you throw something at them they never encountered they fail!

I understood that the address is obfuscated. I was worried that a spammer might have automated processes in place that would convert the code into a regular email address (after all, my e-mail client does this); and that they would automatically remove instances of "+nospam-nospam" from the email address (I understand though, as you pointed out, if I edit the obfuscation strings, this will be very unlikely to occur). This aside, the fact remains that many of my members would struggle to determine the correct email address and make the required edits.

QuoteNevertheless, I do not understand your concerns?  As stated in my last post the member has the ability to  "fix it yourself" through the vast Bad Behavior network.  So your webmaster email is the last resort not the first or only resort.  Please re-read my last post...  Then you will realize it is the last resort.

Again, I'm not sure how my members will fair. When they fail BB, they are presented with the following at the "fix this problem yourself link":

QuoteTechnical Support Your request was intercepted by Bad Behavior (http://www.bad-behavior.ioerror.us/), security software which protects the Web site you visited from malicious activity, such as hackers, spam and viruses. We apologize for the inconvenience, but your request matched a profile of suspicious activity. This problem is usually quite easy to fix.
You accessed the Web site using software which is banned due to malicious activity associated with that software. Uninstall it from your computer and contact the software's author for assistance. In the meantime, you may access the site using different software, such as Firefox.
This problem may be caused by misconfigured or malfunctioning browser privacy software or personal firewall software. If you use this type of software, turn it off or reconfigure it and try again. (Example: For Norton Internet Security, you need to disable the Stealth Mode Browsing feature.)
This problem may be caused by viruses or spyware on your computer, or by malicious software that pretends to be anti-virus or anti-spyware software. Ensure that you have REAL anti-virus and anti-spyware software on your computer, that they are kept up-to-date, and that you have run a full system scan using each tool. Once your system is cleaned of viruses and spyware, please try your request again.
The free Microsoft Security Essentials (http://www.microsoft.com/security_essentials/) provides reasonable protection against a wide variety of malicious software.
If the above suggestions fail to resolve the problem, click Back and contact the e-mail address you were given for further assistance.
 

They will end up needing to contact me, and they will struggle with the obfuscated email address. This is why I am instead considering directing them to a contact form.

QuoteNow this mod has another feature that BB core does not have and that is the ability to place a Project Honey Pot - Honey Pot or a QuickLink in the Warning Page.  What this means if a bot went nuts and clicked on all the links in the warning page it will get penalized with an increased Project Honey Pot warning level.  Not only a deterrent but a no win situation for the bot.

So when it comes to webmaster link security rest assured, I have all the bases covered and will up the technology if and/ or when required.   8)

I will consider adding Honey Pot to the mix. I am just not as convinced as you that those that fail BB will be able to either sort out the problem for themselves, or contact me via the provided email link.

Thanks.

Hello again, Butchs,

I installed BB on my live forum last night, and all seemed well. It was late, so did not spend the time I probably should have done testing out the new feature. The forum and BB appeared to work flawlessly, but when I logged on this morning I found that BB was restricting all visitors on all webpages outside of the forum pages. This problem does not occur when logged into the forum. It appeared to be an SSI issue, so I commented out the SSI entry - this has resolved the immediate problem.

Spam registrations are much lower, but still significant. This was the even the case before I disabled the SSI function. Still, it is early days.

What are the likely consequences of removing the SSI function? I had to edit my SSI file so that manager could apply the BB modification. "// Do we allow guests in here?" did not appear in my SSI file, so I added the line to about where it would have appeared originally. Is it critical where the the following BB SSI function appears in the file?


// Bad Behavior Start
require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php');
// Bad Behavior End

Here's the BB function and surrounding code from my SSI file:

// Get rid of $board and $topic... do stuff loadBoard would do.
unset($board);
unset($topic);
$user_info['is_mod'] = false;
$context['user']['is_mod'] = false;
$context['linktree'] = array();

// Load the user and their cookie, as well as their settings.
loadUserSettings();
// Load the current or SSI theme. (just ues $ssi_theme = ID_THEME;)
loadTheme(isset($ssi_theme) ? (int) $ssi_theme : 0);

// Take care of any banning that needs to be done.
if (isset($_REQUEST['ssi_ban']) || (isset($ssi_ban) && $ssi_ban === true))
    is_not_banned();

// Load the current user's permissions....
loadPermissions();

// Bad Behavior Start
// require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php');
// Bad Behavior End

// Do we allow guests in here?

// Load the stuff like the menu bar, etc.
if (isset($ssi_layers))
{
    $context['template_layers'] = $ssi_layers;
    template_header();
}
else
    setupThemeContext();

// Make sure they didn't muss around with the settings... but only if it's not cli.
if (isset($_SERVER['REMOTE_ADDR']) && !isset($_SERVER['is_cli']) && session_id() == '')
    trigger_error($txt['ssi_session_broken'], E_USER_NOTICE);


I don't know what modification is responsible for the code changes to the SSI file - I'll try to determine this later today or tomorrow. This issue might be the result of my content management system, MODx, although it works fine with SSI calls, except where sessions might be involved (I cannot, for example, make the SSI Logout function work with MODx).

Please let me know if anything immediately springs to mind, or if there is any specific information I can provide to help you determine the cause of this error. There was other error information from MODx displayed with failed webapges that indicated a template. I'll reproduce the error later and copy it here.

Thanks.

You are welcome.  Now that my troll is gone I can post without worrying about him harping in and mucking up things.

Edited because I have been mean to my troll so I decided to chill out and let things be.  Sorry...

Quote from: Col on April 21, 2011, 06:31:28 PM
They will end up needing to contact me, and they will struggle with the obfuscated email address. This is why I am instead considering directing them to a contact form

Though I recommend against it because most users of this mod report little if any members getting blocked.  So, even if you edit the "BadBehavior.english.php" file to un-obfuscate the address, your address will still be difficult for a bot to read and easy for a member to link to.

Quote from: Col on April 21, 2011, 06:31:28 PM
Please let me know if anything immediately springs to mind, or if there is any specific information I can provide to help you determine the cause of this error. There was other error information from MODx displayed with failed webapges that indicated a template. I'll reproduce the error later and copy it here...

Could be MODx since I did not write or test for it.  Other possibilities: Your "$sourcedir" may not be properly defined in your settings.php file or "$sourcedir" global  is not defined as a global when the function started. 

Other than that I will need to see the error. 

Hi Butchs,

Thank you for the reply. Here's a copy of the error message:

QuoteError 400
We're sorry, but we could not fulfill your request for / on this server.

An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.

Your technical support key is: xxxx-xxxx-xxxx-xxxx

You can use this key to fix this problem yourself.

If you are unable to fix the problem yourself, please contact the WEBMA5TER and be sure to provide the technical support key shown above.

« MODx Parse Error »
MODx encountered the following error while attempting to parse the requested resource:
« PHP Parse Error »
 
PHP error debug
  Error:  include(header.php) [function.include]: failed to open stream: No such file or directory   
  Error type/ Nr.:  Warning - 2   
  File:  /home/xxxxxxx/public_html/forum/Sources/Load.php(1746) : eval()'d code   
  Line:  174   
 
Parser timing
  MySQL:  0.0435 s (0 Requests)
  PHP:  2.2996 s   
  Total:  2.3432 s   

I obfusacted the the support key number since I don't know if tehre are any possible issues with copying it here. Let me know if you need it for any reason.

What is the purpose of the SSI function in BB? What are the implications of disabling the function?

Again, thanks.

Thank you for the reply.  The error did not give me enough information for a solid fix.  Maybe in a future version I will try to detect Modx.

The only reason to leave the support key alone is that ties in with Bad Behavior home site and is useless otherwise.

The mod should not be used with that error as it provides too much information.  The code you commented out is duplicated in index.php so as long as the mod works when you are logged in and logged out it should be fine.  I would test it logged out and test it logged in as a regular member who is not an admin.  If it works then you are fine.

I believe this is a modx issue.  If it does not work fine with the code you commented out, I will have to load Modx on my test server.  But I doubt it.

Hi,

I guess I can live with this not working across my whole website. It probably will have little impact, since I do not have any interactive sections outside of the forum.

A few hours ago, I turned on the Honey Pot function. Yes, I joined up, added a key, and even a quicklick. However, I do not detect any reduction in the nuymber of registrations. There is activity in the denied log, but it is not very busy. I still seem to attract the best part of 100 spam accounts a day. They are not getting to the forum, but they are cluttering-up the membership list, and do cause some minor inconvenience for our a approval system.

A more pressing problem is that it appears that every click on the forum is adding the following error to the forum forum error log:

QuoteApply Filter: Only show the errors with the same message
8: Undefined index: id_group
File: /home/xxxxxx/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 436

Do you know what might be behind this problem?

Thanks.

Edit: line 458 sometimes shows up in the error log too.

The mod is designed to work in the SMF system.  Most CMS's will need their own mods.

Try enabling strict mode.

Try replacing "id_group" on line numbers 436 & 458 with "ID_GROUP"?

Replacing with ID_GROUP did the trick. However, there is an occasional new error. It might be an pre-esiting error, but previously hidden by the myriad of other error log entries before I deleted them (there were thousands of pages of entries).

Quotehttp://www.xxxxxxxxx.com/forum/index.php?q=favicon.ico
Apply Filter: Only show the errors with the same message
Database Error: No database selected
File: /home/xxxxxx/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

Any ideas?

I think I will install my forum from scratch, adding the modifications afresh. However, I'll first add BB with the minimum of other modifications and see how things go. At the moment, BB seems to be making little difference. My core forum installation is old, so the core code has been knocked around for a long time.

Thanks.

The mod does not use "favicon.ico".  Not sure what the issue is but if it happens infrequently then do not worry.  Could be a bot checking for vulnerabilities or an issue with your CMS.

BB blocks bad bots but does not protect registration.  You should see many bots bet blocked.  It takes 1-2 weeks before they slow down.  If you want registration protection may I suggest "Avatar_Verification" with 100 images.

I saw you site the other day and it looks easy to log in there.  I do not know how bad you problem is but if you are still getting hit hard after the above mod is installed then you may need to try the big gun Forum Firewall.

If you do make sure you run it in log mode for a few days before blocking things.  You will have to make the same sorta change to ssi.php.

New version posted today.  They are minor bug fixes and the core was updated to 2.1.13:

New in this Core release:

• A logic error in the search engine handling code caused search engine requests to be subjected to additional checks not appropriate for them. This was causing Yahoo! crawler requests to be inadvertently blocked. This error has been fixed.
• New IP address ranges for Google and Yahoo!, which were previously unused for crawling, have been added to Bad Behavior.

This mod seems very promising. Thanks for the updated version, butchs. Keep up the excellent work!

BTW, what exactly changed in this new version?

Fix for Undefined index: id_group & description of error link (thanks Dmytro) in 1.1.x. 

Updated to Bad Behavior core version 2.1.13 (see my last post for the list of changes).
:)

Thanks for the update butchs.  :)

butchs

I'm not sure if this was corrected in 1.4.7 (I'm still on 1.4.6) but I've noticed that in the Denied Entries Log, when you click on the DENIED key, the resulting link to the details is incorrect.

The last bit of the link is coming up as:

............area=badbehavior;sa=report_denied;%20bbbbid=116

when I think it should be:

............area=badbehavior;sa=report_denied;%20bbid=116

Too many b's

See attchment for the area I'm referring to.

Cheers  ;)

Yea that was one of the 1.4.7 fixes.

Cool  ;)

Thank you for providing this mod. I have just installed it for the first time, but it looks very promising.

One potential problem though. As far as I can make out, the error messages (the link to "Fix it yourself" etc.) are hard-coded in English, and doesn't seem to use the language files. It could be a problem, if the site is used on a non-English site and a legitimate user who doesn't know English happens to get caught by the script. It's no big deal and will probably affect very few people, but it would still be nice to be able to change the error messages to the site's language.

You are correct and there is not much I can do about the Fix it yourself" message at this time.  The link to Fix it yourself" is part of the Bad Behavior core site.  Bad Behavior core is English only and this is the only port that supports other languages.  Maybe for a future version I can try something different for that message in a non-English language.  I will plan to to discuss this with the core author.
:-X

Guest    Today at 10:07:29
http://www.gearsofgaming.com/forums/index.php
Database Error: No database selected
File: /home/gear2129/public_html/forums/Sources/bad-behavior/BadBehavior-SMF.php
Line: 74

SMF 1.1.13 Any suggestions? Im using FPS theme and have applied the needed necessary manual edits to the themed files per the parser.
Im getting the above error about 12 times a day or so.



Modification Packages
   Mod Name    Version    
1.    SP Block for HacksPark ShoutBox    1.0    [ Uninstall ] [ List Files ] [ Delete ]
2.    Stop Spammer    2.3.9    [ Uninstall ] [ List Files ] [ Delete ]
3.    HacksPark shoutBox    1.2.1    [ Uninstall ] [ List Files ] [ Delete ]
4.    SMF 1.0.21 / 1.1.13 Update    1.0    [ Uninstall ] [ List Files ] [ Delete ]
5.    httpBL    2.5.1    [ Uninstall ] [ List Files ] [ Delete ]
6.    Custom Profile Field Mod    3.19    [ Uninstall ] [ List Files ] [ Delete ]
7.    Ultimate Profile    0.9    [ Uninstall ] [ List Files ] [ Delete ]
8.    reCAPTCHA for SMF    0.9.5.4a    [ Uninstall ] [ List Files ] [ Delete ]
9.    Googlebot & Spiders Mod    2.0.4    [ Uninstall ] [ List Files ] [ Delete ]
10.    DisableTemplateEval    1.1    [ Uninstall ] [ List Files ] [ Delete ]
11.    SimplePortal    2.1.1    [ Uninstall ] [ List Files ] [ Delete ]
12.    FlashChat Integration    1.0    [ Apply Mod ] [ List Files ] [ Delete ]
13.    Bad Behavior mod    1.4.7    [ Uninstall ] [ List Files ] [ Delete ]
14.    Google Verification META Tag    1.0    [ Uninstall ] [ List Files ] [ Delete ]

When you do a manual installation you need to run the routines in "install_db.php" for the database to be set-up.  Otherwise it will not work.


Also, do not forget to copy the cache directory...

See "package-info.xml" for more info.

Hello butchs,

Your BB modification seems to be working quite well, but I decided, like you, to add Stop Spam and httpBL. The warning page for httpBL has a poorly obfuscated e-mail address system in place - I tried copying the unicode generated by your system to help protect the address from harvesters, but when saved it is converted to plain text in the HTML. What did you do to protect your e-mail address in httpBL?

Quote from: butchs on May 07, 2011, 07:22:27 AM
When you do a manual installation you need to run the routines in "install_db.php" for the database to be set-up.  Otherwise it will not work.


Also, do not forget to copy the cache directory...

See "package-info.xml" for more info.

What I actually did was an automatic install, then applied edits needed to the theme files.
Was that incorrect?
I put install_db.php in the root and went to that path and got a blank white screen, so not sure if that was successful or not?

Quote from: Col on May 07, 2011, 08:27:56 AM
What did you do to protect your e-mail address in httpBL?

The current version of BB uses Project Honey Pot so I stopped using httpBL mod and enabled the honey pot feature of BB.

Quote from: J-Bird on May 07, 2011, 09:00:57 AM
I put install_db.php in the root and went to that path and got a blank white screen, so not sure if that was successful or not?

J-Bird, I just went to your site and the mod is working.  Scratch number 2.  So the only issue I can think of is the log working?  If not check phpadmin.

Use phpadmin to check to see if thee is a "log_badbehavior".  If the file is missing then the db was not installed.

My link to bad behavior is missing from my Admin > configuration section of my forum.

I installed it two days ago and it was working fine, I also installed honeypot then and it was working well too. However last night bad behavior disappeared as mentioned above and my honey pot  says ...

Mod httpBL is ON, it is up-to-date and the connection with HoneyPot is perfect. (But it does not have a green background like it had when I first put it on my site.)

AND whenever I click spammers log, human log or help I get

An Error Has Occurred!
Unable to load the 'httpBL' template.

Are the two problems  the same, is it a honey pot problem?

Thanks
S

I uninstalled and then reinstalled it and it seems to work fine.

Sorry, didn't think about that until after my above post

I've had some reports of some of my members getting trapped in this. I'm using the http:bl feature and some of their ips match what's in the database but the members are also logged in and as such have the bad behaviour whitelist group permission. Why are they getting checked if they have this permission?

Being logged in does not automatically give you whitelist permissions.  You will need to set their group permissions in:

The following will check both their user name and last used ip address:
Manage Permissions/General Permissions/Bad Behavior Whitelist Group


and/ or you can put their ip address in the BB file for a fixed ip address or range:
s0urces/bad-behavi0r/bad-behavi0r/whitelist.ini

The former is the best.  But if their ip address changes every day the latter may be the better choice.  However, I will use it sparingly.
:)

QuoteThe following will check both their user name and last used ip address:
Manage Permissions/General Permissions/Bad Behavior Whitelist Group

You mean this checks them if they have this permission? Why is it called whitelist? The members had this permission.

Quote from: Darkness* on May 12, 2011, 08:37:14 AM
You mean this checks them if they have this permission?

The admin sets the permissions for each member group.  You need to check the box I described above.

Quote from: Darkness* on May 12, 2011, 08:37:14 AM
[ Why is it called whitelist?

It is an term selected by the BB core author (http://bad-behavior.ioerror.us/).

Quote from: Darkness* on May 12, 2011, 08:37:14 AM
The members had this permission.

If they were blocked then the SMF cookie expired and they had to re-log in.  If their ip address changed then they could ben blocked again.  If this is the case then use "whitelist.ini" with their ip range as described above.

just a quick question...

Do I need to enable project honeypot for this mod to work correctly?

The mod will work without it.  Adding project honeypot will improve results.

great, thanks for the quick response. It seems to be working rather nicely as is at the moment, so won't bother with honeypot unless things change.

I am glad to hear that.
:)

Hello i posted ina the support forum and you told me that this was the right place.


I feel so seriosly stupid and noobed I have NO clue what to do now :S

You told me I had to manually uninstall the mod, I have no clue how to :S

I have the 1.4.7 version, and Im clueless how to manally uninstall, I dont want to crash the site again, now since the other guy in my clan is having is wife on hospital with theire baby coming I have no support from him

The last thing he told me was that I had to make the mod run in english and uninstall all the other language packages beckause the mod fails on a file, how do I do that or shall I just uninstall it manuall?

In that case how? :S when uninstalling it in the admin panel site crashed :S i dont want to fukk it up now :S

Please tell me how

Please help me cus the mod made AEVA media fukk it up now now, so many errors poping up!!!!

The best prevention is to install a mod once.  You need admin/ FTP access to manually uninstall a mod.

I can not guarantee this but you can try the following (if you have SMF 1.1.x - 2.x will require more work):
Unzip the mod and copy everything that is in the Sources directory in the mod to the Sources directory in your server.  Then copy the compressed mod to your Packages folder on your server.

All should work.  Wait until your tech comes back from the honeymoon and try to uninstall the mod again via the package manager.

They you should be fine.  But whatever you do never install any mod twice!

Quote from: K33NY on May 31, 2011, 12:25:02 PM
The last thing he told me was that I had to make the mod run in english and uninstall all the other language packages beckause the mod fails on a file, how do I do that or shall I just uninstall it manual?

That is not true.  The mod will run in the language you set in the SMF admin panel.

we are running SMF 2.0 RC5 and I have FTP access, shall I try what you told me or better to wait until he comes back?

Allso I wonder, should I uninstall all mods, for then to be sure i install them 100% correct again later?

I was thinking of doing this, I would rather spend hours installing mods properly than using hours installing wrong to having them make errors.....

If all is well wait.  If not then for SMF 2.0 copy the following files onto your server in the order they appear in package-info.xml.

If everything is working.  Wait for your tech returns he should be able to uninstall the second copy of BB in package manager.

the above is not a manual uninstall, it is more or less a workaround I developed when I double installed things on my test server when I was up too late programming.   :o

ok then I will wait, I think, I want to learn this stuff myself but I dont know anyone to teach me, so I will ask him to uninstall all mods properly for me :)

Yea, it is not that hard to learn SMF.

No I found this much easier then what we used before, but still bit much for me at once :P

Oh, I just read you other post.  You can not uninstall mods by simply deleting files.   Mods must be uninstalled via package manager.   If you reinstall the files you deleted, your site will work again.

FYI - If you use the honeypot link feature please note that you have to use the complete address.  ie http://www.yoursite.com/folder/honeypot.php

New version for the upcoming SMF 2.0 and past versions.

Additions are:
1.  Advanced automatic random Google safe scattered honeypot generates many different invisible spam traps on front page and warning page.  Currently this mod generates more types of spam traps than any other mod.  This makes the spam traps generated by this mod more effective.  Honey pots must be entered in the mod admin page as a complete link.  ie:  "http://community.smfhelper.info/honeypot.php".
2.  httpBL suspicious visitors are now logged as "Permitted Entries" when logging and HttpBL are enabled.
3.  Bug fixes and etc...

Butchs, can you give me sql query of install_db.php for fresh install? for some reason can't install it via smf or manually always get stuck in

No database selected
File: /home/user/public_html/forum/install_db.php
Line: 269

Edit: i see the entry is there in setting badbehavior_* and log_badbehavior_* but always give me the error

Database Error: No database selected
File: /home/user/public_html/forum/Sources/bad-behavior/BadBehavior-SMF.php

Odd.  Try adding the attached to your package.

EADIT:  removed for security reasons please PM author for a copy.

Same, here line BadBehavior-SMF.php problem.

function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}

Sounds like a host issue to me. The mod works fine on thousands of other sites.

I uninstalled and reinstalled the mod on my site and reduced the number of Database Error: No database selected errors. I used the version 1.5 I re-downloaded from SMF today.

I'm still getting this error whenever an IP is DENIED however. It seems to be working on my 1.1.14 forum (greatlakesbass.com/forum). I have the database tables and the errors are getting logged in log_badbehavior. I checked everything that I found in earlier posts in this thread. I already had httpBL and Stop Spammer installed.

5 of these errors in the last 1/2 hour. Here's the mods I have installed:
Mod Name Version
1. Tidy Child Boards 1.2 [ Uninstall ] [ List Files ] [ Delete ]
2. Stop Spammer 2.3.9 [ Uninstall ] [ List Files ] [ Delete ]
3. SMF 1.0.17 / 1.1.9 / 2.0 RC1 Update 1.0 [ List Files ] [ Delete ]
4. SMF 1.0.12 / 1.1.4 / 2.0 b1.1 Update 1.0 [ List Files ] [ Delete ]
5. SMF 1.0.21 / 1.1.13 Update 1.0 [ List Files ] [ Delete ]
6. Bad Behavior mod 1.5.0 [ Uninstall ] [ List Files ] [ Delete ]
7. SMF 1.1.14 Update 1.0 [ Uninstall ] [ List Files ] [ Delete ]
8. SMF 1.0.19 / 1.1.11 Update 1.0 [ List Files ] [ Delete ]
9. SMF Gallery Pro 3.0.21 [ Uninstall ] [ List Files ] [ Delete ]
10. SMF 1.0.11 / 1.1.3 Update 1.1 [ List Files ] [ Delete ]
11. Anti-Spam Verification Questions 1.02 [ Uninstall ] [ List Files ] [ Delete ]
13. SMF 1.0.13 / 1.1.5 / 2.0 b3.1 Update 1.0 [ List Files ] [ Delete ]
14. Bookmarks 2.3 [ List Files ] [ Delete ]
15. PaypalDonations 2.0 [ List Files ] [ Delete ]
16. httpBL 2.5.1 [ Uninstall ] [ List Files ] [ Delete ]
17. SMF 1.0.14 / 1.1.6 Update 1.0 [ List Files ] [ Delete ]
18. Simple Audio Video Embedder 2.0.1 [ Uninstall ] [ List Files ] [ Delete ]
19. SMF 1.0.16 / 1.1.8 Update 1.0 [ List Files ] [ Delete ]
20. SMF 1.0.18 / 1.1.10 / 2.0 RC1-2 Update 1.0 [ List Files ] [ Delete ]
21. SMF 1.0.15 / 1.1.7 Update 1.0 [ List Files ] [ Delete ]
22. Addthis widget in first post 1.0 [ Uninstall ] [ List Files ] [ Delete ]
23. SMF 1.0.20 / 1.1.12 Update 1.0 [ List Files ] [ Delete ]
24. ARIN URL Fix 0.1 [ Uninstall ] [ List Files ] [ Delete ]
25. SMF Gallery Pro Profile Link 1.1 [ Uninstall ] [ List Files ] [ Delete ]
26. SMF Gallery Pro SSI 2.1.1 [ Uninstall ] [ List Files ] [ Delete ]

Any more ideas on how to get rid of this error message? Thanks.

Also, minor, whenever I click on the About link in Bad Behavior I get the following error:
http://www.greatlakesbass.com/forum/index.php?action=badbehavior;sa=bbabout;sesc
Apply Filter: Only show the errors with the same message
8: Undefined index: badbehavior_httpblnote
File: /home/accountname/public_html/forum/Themes/default/BadBehavior_Admin.template.php (badbehavior_about sub template - eval?)
Line: 144

I was getting this before I reinstalled Bad Behavior the 2nd time too. Thanks.

I just went to your site and ran "Bad Behavior Test" and it seems to be working.

Not sure what is going on with the DB errors.  From past experience it was usually a bad install.  Could be left over cache from the old install or it could be that files are in the incorrect locations.  Maybe you have SMF 2.0 files mixed with 1.1.x files?  Since you have a custom theme I would check what is installed where.

If not please provide more info.  I run 2.x live so I can only test 1.1.x locally.  EDIT:  Went back to the test forum, upgraded it to 1.1.14 and forced a log entry, I get no DB error with Apache 2.0.63 ,MySQL 5.1.44 & PHP 5.3.2.

The attached should fix badbehavior_httpblnote for 1.1.x.  Thank you.  It will be added to a future revision when I collect more.

I will revisit this post:

Quote from: Kurogane on June 11, 2011, 03:00:48 PM
Same, here line BadBehavior-SMF.php problem.

Code Select Expand

function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}

From what I see you are running SMF 1.1.x, the global "$db_prefix" is required to locate your database.  It is defined in your "Settings.php" located in the smf root directory.  Please run "repair_settings.php (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php)" to confirm that it is set correctly or inspect the "Settings.php" file directly.

The "$db_prefix is used in the "BadBehavior-mysql.php" for the "bb2_insert" function.  SMF 1.1.x requires it to be in the format of "{$db_prefix}xxx".  This is not required for SMF 2.0.x so if you will get errors with the wrong "xxxr-mysql.php"  file.   Custom theme installers need to be careful.

If you have a SSI front end then you need to add the xml changes in both the the "index.php ' & "SSI.php" files.
:)

The new file fixed that minor issue for the About link badbehavior_httpblnote for 1.1.x - thanks!

Bad Behavior seems to be working as it should. If you mean non-Bad Behavior files I don't think I could have SMF 2.0 files on there since I've never used any 2.0 install/update on that account. I do see that the version 2.0 Bad Behavior files were installed in /public_html/forum/Sources/bad-behavior and /public_html/forum/Sources/bad-behavior/bad-behavior. Is that okay?

My theme is an edit I did of the default theme myself a long time ago. I'll check files some more today or tomorrow and see if everything seems to be where it is supposed to. I don't normally have any strange errors or problems installing things. I haven't seen indications in the past that files weren't where they were supposed to be. Guess I can check the install manually in detail to see if all the Bad Behavior changes were made as they should be. I manually edited my index.template.php file in my theme with the two changes.

The leftover cache possibility would be nice because then I expect it will go away. That would be nice. So far, still getting the error in my log whenever someone is denied.

On my theme I have an index.php, index.template.php and style.css, and an images folder in the glbtheme2 folder under Themes. Everything else is in the default folder. That was what happened when I ran the process 'Create a copy of Default named:' in SMF way back.

If you are getting "Denied Entries" in the mod log then it is working.  Something else may be the issue???

Try this:
Check your "Settings.php" as mentioned in reply 262.  Check the other issues too.

Another thing will be to install "DisableTemplateEval (http://custom.simplemachines.org/mods/index.php?mod=2054)" and disable it.  Then send me some of the errors you are getting from the SMF Error log (a/k/a Forum Error Log).

You can manually force them by logging out and changing your UA to "Bad Behavior Test".

Quote from: djkimmel on June 12, 2011, 06:31:32 PM
Bad Behavior seems to be working as it should. If you mean non-Bad Behavior files I don't think I could have SMF 2.0 files on there since I've never used any 2.0 install/update on that account. I do see that the version 2.0 Bad Behavior files were installed in /public_html/forum/Sources/bad-behavior and /public_html/forum/Sources/bad-behavior/bad-behavior. Is that okay?

Not sure if I understand.  You need to look at "package-info.xml".  If you uncompress the mod zip file,  BB files in "Sources" and "Themes" folders are for 1.1.x.  Most of the the 2.0 files are in the root folder.  The common files are the language files.

This is a mute point if you used package manager as it installs the correct version.

Quote from: djkimmel on June 12, 2011, 05:02:58 PM
I have the database tables and the errors are getting logged in log_badbehavior. I checked everything that I found in earlier posts in this thread. I already had httpBL and Stop Spammer installed.

log_badbehavior is not collecting errors, it is keeping a log of the blocked visitors.  If the log is maintained the DB errors you see are most likely from something else.  It is impossible for "log_badbehavior" not to be found and write to the DB at the same time.  If there was a BB DB error it would not write to the log at all...   The procedure I outlined above may assist you in locating the real source.

SMF errors are kept in the Forum Error Log.
???

httpBL is redundant when using this mod.  This mod does everything that mod does plus a whole lot more.  Plus this mod is much less complicated when it comes to Project Honey Pot.
:-X

I used the Package Manager. Not exactly sure how to read what the package-info.xml files does. It appears you are saying that the files in /forum/Sources/bad-behavior/bad-behavior are for version 1.1.14.

By errors I did mean it is logging the blocked visitors. Since it is writing to the log in the database I thought it odd that it would report 'Database Error: No database selected' even though it is writing to the database. The IP addresses in my errors log where this message is being reported match the IP addresses being denied by Bad Behavior along with the times they are recorded in log_badbehavior.

I am getting denied entries. 6 more since 8pm EST. I'll try the eval and settings stuff and see what I come up with.

Okay. I went through the database and looked at things closely since I'm not getting this error with every denied IP address. Only some of them. I see a pattern. I have Prismotube installed under a different subdirectory - greatlakesbass.com/vid/ - than the forum and for some reason Bad Behavior is also checking requests for /vid/ video pages. Not sure how or why this is happening since they are outside of the forum path?

So when an IP address is denied by Bad Behavior along the greatlakesbass.com/vid/ path instead of the greatlakesbass.com/forum/ path, I usually get the 'Database Error: No database selected' error on the forum. I have other PHP programs running on greatlakesbass.com but the forum and the video sections are my highest traffic areas.

I notice Bad Behavior is also checking requests against greatlakesbass.com at the root level too. I thought it would only check traffic to the forum? No indication so far that it is also checking traffic against my blog software. Is it possible it is checking against the root and the video section because I call SSI.php on them?

This is my last post for today.  Gotta go to bed...   O:)

Quote from: djkimmel on June 12, 2011, 08:09:48 PM
I used the Package Manager. Not exactly sure how to read what the package-info.xml files does. It appears you are saying that the files in /forum/Sources/bad-behavior/bad-behavior are for version 1.1.14.

Yes.  I believe you have installed it correctly.

Quote from: djkimmel on June 12, 2011, 08:09:48 PM
By errors I did mean it is logging the blocked visitors. Since it is writing to the log in the database I thought it odd that it would report 'Database Error: No database selected' even though it is writing to the database.

True.  If the log is maintained the mod is working.

Quote from: djkimmel on June 12, 2011, 08:09:48 PM
The IP addresses in my errors log where this message is being reported match the IP addresses being denied by Bad Behavior along with the times they are recorded in log_badbehavior.

Quote from: djkimmel on June 12, 2011, 08:29:28 PM
Okay. I went through the database and looked at things closely since I'm not getting this error with every denied IP address.

When I visited your site with a "Bad Behavior Test" UA there should have been a "log_badbehavior" entry and nothing in the error log for my ip (please do not post my ip).  If this is the case you are being attacked.  :)

Could it be that you are are being hit by bots that are trying to access your forum DB?  The errors you see in the errors log could be the bots trying to write to your forum without permission.  I would move over the httpBL information to BB and disable mod httpBL so BB will block both.  No need for redundant mods.  Besides this way you can take full advantage of the cache feature and block other attempts.

Check the time stamps.  Bots hit rapidly but the time stamps should match if it was really a mod error.  If not, cache will catch the bots even longer.

I would add some cache to the BB mod 8-15 seconds so it will block other access attempts from the same IP address the duration of the cache until the bot tide blows bye.

Bots try many different things.  Some times they are caught by BB some times by the project honey pot feature.  Other times they get a free pass.  But with cache they get blocked a little longer.  Cache also reduces the wear and tear on your forum.

Quote from: djkimmel on June 12, 2011, 08:29:28 PM
Only some of them. I see a pattern. I have Prismotube installed under a different subdirectory - greatlakesbass.com/vid/ - than the forum and for some reason Bad Behavior is also checking requests for /vid/ video pages. Not sure how or why this is happening since they are outside of the forum path?

Me either?  Unless it has the same path as the forum.  Maybe Prismotube has its own copy of BB?

Quote from: djkimmel on June 12, 2011, 08:29:28 PM
So when an IP address is denied by Bad Behavior along the greatlakesbass.com/vid/ path instead of the greatlakesbass.com/forum/ path, I usually get the 'Database Error: No database selected' error on the forum. I have other PHP programs running on greatlakesbass.com but the forum and the video sections are my highest traffic areas.

The path for the forum db is set in "Settings.php" via the "Database Info" section.

Quote from: djkimmel on June 12, 2011, 08:29:28 PMI notice Bad Behavior is also checking requests against greatlakesbass.com at the root level too. I thought it would only check traffic to the forum? No indication so far that it is also checking traffic against my blog software. Is it possible it is checking against the root and the video section because I call SSI.php on them?

Could be.  But the path to the db will not change.  Maybe bots are trying to access your forum db when they are at the forum like I said before.  If it is logged in "log_badbehavior" then the db is working.  This is why I am perplexed and have the suspicion that it is a bot attack.

Thanks for your help. Well I wish I could figure it out a little better. My forum path is greatlakesbass.com/forum in Settings.php. I have to believe it is the SSI.php connection since that is the common denominator between my home page, the forum and Prismotube. Prismotube does not have a Bad Behavior function of its own. I now see Bad Behavior ran against another path outside the forum that also has an index.php file that uses SSI.php.

I realize the path of Bad Behavior doesn't change but there is some kind of path problem when Bad Behavior runs against my Prismotube files on greatlakesbass.com/vid/ and other non-forum paths.

I increased the cache time from 8 to 15. I turned off the httpBL mod since I have the settings in Bad Behavior. I'll see what happens with that.

Out of the 1440 records already in the Bad Behavior log, I have no idea which one is your entry anyway so your IP address is safe.

Next time your awake and read this, what would be the ramifications of removing the Bad Behavior code from SSI.php? Would that stop Bad Behavior from running against all the non-forum pages? Not sure if I want to do this but I am getting a lot of the no database selected errors.

I like the idea of SSI helping the mod protect your whole site.  SMF never fails to amaze me.  I would advise not to touch it...

Out of sight, out of mind?  If you disable the mod by tampering with SSI the bots will not stop.  Even if you do not see them they will still be attacking your site.  They will never go away unless you use the mod.

Why blame the mod for protecting your site?  The errors are not from the mod because the mod is logging the violations.  Bots are causing the errors in your forum error log.  The mod is blocking the bots.  Some times bots step up their assault when threatened.  Just because the IP's match it does not mean the mod is at fault.  Your problem is and always was the bots.  Let the mod do it's job and in a few weeks things will slow down and they will go elsewhere.

You have less than 300 blocked.  The other 1,100 are permitted.  Look in the denied log for the ones that were blocked.

Quote from: butchs on June 12, 2011, 06:12:49 PM
I will revisit this post:

Quote from: Kurogane on June 11, 2011, 03:00:48 PM
Same, here line BadBehavior-SMF.php problem.

Code Select Expand

function bb2_db_query($query) {
global $db_prefix; <-- Error here

if ((!isset($query)) || (empty($query))) return false;
$link = db_query($query, __FILE__, __LINE__);
if (!isset($link) || empty($link)) return false;
if ($link === true) {
$affected_rows = bb2_db_affected_rows();
if ($affected_rows >= 1) {
return true;
} else { return false; } 
} else {
$number_of_rows = mysql_num_rows($link);
if ($number_of_rows == '0') {
return false;
} }
$qresult = bb2_db_rows($link);
return $qresult;
}

From what I see you are running SMF 1.1.x, the global "$db_prefix" is required to locate your database.  It is defined in your "Settings.php" located in the smf root directory.  Please run "repair_settings.php (http://download.simplemachines.org/index.php?thanks;filename=repair_settings.php)" to confirm that it is set correctly or inspect the "Settings.php" file directly.

The "$db_prefix is used in the "BadBehavior-mysql.php" for the "bb2_insert" function.  SMF 1.1.x requires it to be in the format of "{$db_prefix}log_badbehavior".  This is not required for SMF 2.0.x so if you will get errors with the wrong "BadBehavior-mysql.php"  file.   Custom theme installers need to be careful.

If you have a SSI front end then you need to add the xml changes in both the the "index.php ' & "SSI.php" files.
:)

Yeah i'm using SMF 1.1.13  and i ran"repair_settings.php" all fine here.

For the moment i upgrade smf 2.0 and i still modifying some things for the migration when i done this i'll try again with smf 2.0

Quote from: djkimmel on June 12, 2011, 05:02:58 PM

I'm still getting this error whenever an IP is DENIED. I have the database tables and the errors are getting logged in log_badbehavior.

This is the exact problem i have. I got this error when all the IPs are DENIED, i'm not really sure if the errors i getting logged in log_badbehavior are the actual or updated but it saves the registry, that's for sure.

Again, if the mod is maintaining a log then the mod is working.  log_badbehavior  is not an error log.  It tracks the denied and suspicious permitted visitors.

Sounds like bots are causing the errors by taking advantage of a flaw in SMF 1.1.x.  No matter what version of SMF you have bots will try to place errors in your forum error log.  They are trying to retaliate because you are blocking them.  That is what they do!

Please do not blame the mod for doing it's job.  Set up the mod correctly and the bots will eventually slow down and give up.

I'm not blame you for doing it's jobs, In my case I can put hands on fire they are not a bots they are legit users only the IP their using is reported for comment spammer or malicious IPs (Dynamic IP problem) i know this because i investigate the IP reported and the users using the IP and are known users.

Oh I appreciate the help. Just wondered what would happen if I edited SSI.php. I like information and learning. I'll leave it as is because the bots are relentless. Same as the number of IP addresses constantly attempting to log into my server. Endless and relentless. I appreciate the protection. After editing the permissions I have not seen any indication of real members being blocked or affected by Bad Behavior. I had a few affected by httpBL mod but I shut that off at your suggestion.

I had only one signup so far today that was stopped by Stop Spammer. I used to get 12 to 18 like that a day. It is amazing to me the effort spammers will go to to get around all the walls we throw up in front of them.

Thanks for your help and information.

Kurogane if "Search Engine DNS" is checked uncheck it.

You can put your members on a whitelist.  Make a Membergroups for them and check "Bad Behavior Whitelist Group" in the Permissions.  This will only work if their ip does not change from the last one they used on your site when they are logged out.  If their ip does changes after they log out they will not be white listed.  If they do not log out then they are ok.  Another option is to add the ip range in "whitelist.ini" in your "sources/bad-behavior" folder.

djkimmel you are welcome.  Not sure what will happen but I know it will not work on a SSI site with the ssi stuff turned off.  I suggest letting things go for a week.  What I have seen is that when BB starts blocking bots the bots hit the site hard.  They get blocked and after a week or two they take you off the list and visit less frequently.

Maybe placing your most active membergroups in the "Bad Behavior Whitelist" is not a bad idea?  All member groups with 50+ posts get automatically white listed.

Quote from: djkimmel on June 13, 2011, 11:53:44 AM
I had only one signup so far today that was stopped by Stop Spammer. I used to get 12 to 18 like that a day. It is amazing to me the effort spammers will go to to get around all the walls we throw up in front of them.

I was shocked when I discovered how many attempts the bots were making on my site a day.  No more...   :)  8)

I did whitelist all my members. I haven't had a spammer get all the way on past Stop Spammer in a while so I should be okay. I'll change permissions to exclude members with less than 10 posts from the whitelist is things change.

It will be good to see the bots traffic down on my site. I'm starting up other websites and I want to be able to have tools to minimize their impact on those sites too. Thanks again.

since I installed smf 2.0 gold, bad behavior has stopped working completely. Tried uninstalling, deleting and installing the new version - still not working at all.

When the mod is uninstalled it disables its self.  You need to check "Enable Bad Behavior" to turn it back on after installation.   8)

Quote from: djkimmel on June 13, 2011, 08:27:29 PM
I did whitelist all my members. I haven't had a spammer get all the way on past Stop Spammer in a while so I should be okay. I'll change permissions to exclude members with less than 10 posts from the whitelist is things change.

It will be good to see the bots traffic down on my site. I'm starting up other websites and I want to be able to have tools to minimize their impact on those sites too. Thanks again.

Good idea!  Now your members will not be tested.  Drastically reducing possible conflicts with the Project Honey Pot part.

Quote from: butchs on June 14, 2011, 03:23:58 AM
When the mod is uninstalled it disables its self.  You need to check "Enable Bad Behavior" to turn it back on after installation.   8)

It is enabled but since installing smf 2.0 gold - it has stopped working, even with project honey pot configured correctly. My forum is now being overrun by ze nasty gremlins :(

Hi, I've recently installed Bad Behavior on my site and it appears to be working (there have been denied connections, all appear to be spammers).  But I had one slip through (as is bound to happen).  When I checked the ip on project honeypot I saw it's threat level was 45, which confused me. 

I have a minimum threat level of 25 in the config on the site, and I have my http:BL Access Key set, so I would have expected that it would have filtered that out?  The person was added to the "PERMITTED entries log", but I'm just not quite sure I have everything setup right so I thought I would ask what the appropriate behavior should be?

Yes it would have been filtered.  I suspect its threat level was below 25 when it first visited your site.

If you have a honey pot they could have clicked it ands raised their level while on your site.  The honey pot routines generated by the mod are quite effective.  If caught, they paid a heavy price spamming you by getting black listed.

Their threat level could have been raised elsewhere.  Nevertheless, they recently visited a honey pot and will not be able to access your site for a while.

Quote from: tabletsdroid on June 14, 2011, 07:47:34 AM
It is enabled but since installing smf 2.0 gold - it has stopped working, even with project honey pot configured correctly. My forum is now being overrun by ze nasty gremlins :(

Any errors in the SMF Error log?

What happens when you log out and visit your site with the "Bad Behavior Test" as your UA?

There is going to be an update this weekend for both 1.1.x and 2.0.x.  In the mean time please replace the attached in your sources/bad-behavior/bad-behavior folder.  It will not effect un-installation.

Hello all,

I am curious if I have to do anything after installing this mod? Being a complete noob to this particular aspect of SMF, I would not be sure what to do. Can it just be installed we me not having to do anything after?

You need to enable the mod.

Quote from: butchs on June 16, 2011, 07:55:53 PM
You need to enable the mod.

Well, besides that obviously. :)

New update.  Fixed some project honey pot issues.  If you use httpBL and the mod is working you can just replace the core.inc.php & blackhole.inc.php files to get the features of the update.

Hi, new to this mod.  After mod was installed I get weird random characters on the top left corner of my forums.  Sometimes there's nothing but if I keep hitting refresh the characters will sometimes appear or change.  Is this normal?

With honeypot traps enabled, the mod generates many random project honey pot traps in an effort to catch bad bots.  The mod generates more traps than any other mod in SMF or other forums that I know about.  The traps vary and some are unique.  I created several new ones that bots never seen before.  The traps dramatically increase the effectiveness of the traps and deter the bots from clicking everything.  Details of the traps are confidential since bot authors regally read these threads.

The more "mild" traps are placed on your front page.  Where more "aggressive" traps are used when a visitor is blocked via the warning page.

Some times the mod will put something up top.  You should not see anymore than a extra blank line up there.  If you see actual characters else, please PM me it to me.
8)

Just thought I'd share:

"Bad Behavior has blocked 769 access attempts in the last 7 days." I installed this mod two days ago. Holy crap.  :o

I saw "Request contained a malicious JavaScript or SQL injection attack" on a few of the denied log entries. I think that would explain why my site was sluggish before installing this mod? Among other attacks I suppose.

I am glad I installed this mod. I will be recommending it to everyone I know who has a blog, website or forum.

Great mod.  8)

New version.  Can't have a default valueFile (evanoliver), added httpBL on/off line & API key check, improved whitelist.
:)

Quote from: LC on July 10, 2011, 02:48:30 AM
Just thought I'd share:

"Bad Behavior has blocked 769 access attempts in the last 7 days." I installed this mod two days ago. Holy crap.  :o

I saw "Request contained a malicious JavaScript or SQL injection attack" on a few of the denied log entries. I think that would explain why my site was sluggish before installing this mod? Among other attacks I suppose.

I am glad I installed this mod. I will be recommending it to everyone I know who has a blog, website or forum.

Great mod.  8)

Thank you very much for the kind words.  :'(

I have a personal best at my website with this version:

QuoteBad Behavior has blocked 718 access attempts in the last 7 days.

400 of them were today!

ROCK and ROLL!!!   :P

I've updated to 2.0 and I'm having a problem with BB, basically, the hidden url its creates in the head of the forum pages, it sometimes ads the link text as a html character code or a html comment, these show up as a white bar about 12px high across the top of all forum pages.

If the random link text is a string it works fine and doesn't show the white bar, any ideas?

I believe it's the random honeypot trap.  Not sure which one. 

If you like view your source to identify it, PM me it and I can tell you where it is...

Mine hit:
Bad Behavior has blocked 1322 access attempts in the last 7 days.
Within four days of installing, before we changed servers and the URL went down for a while. Ridiculous. I had never realized we'd gotten so much bot traffic before. It would have been higher no doubt had I not cleared out the logs to make the DB smaller. 52.3 MB, and 51 of those MB were all BB logs. >>

The BB Logs clear themselves after 7 days.

New version.

What's included?

• Fixed rare error with Cloudflare Server.
• Added suspicious BBC
• Limited honeypots

Besides some minor bug fixes for cloudflare uses, a option to limit the honeypots on the front forum page, I will introduce a new BBC code for SMF 2.0 only (It is too difficult to implement in 1.1.x).  This code will block content from suspicious visitors who are guests.

For example, if you have a meeting and want to post your email address, instead of just posting it you can enclose the content in the new BBC code.  If a guest gets flagged suspicious by BB they will not be able to see the information.  But a logged in user or a guest who is not suspicious will be able to see the information.

This has been the path I have been heading to for a while and is the goal of the final 1.5.x version of the mod.  The integration hooks in SMF 2.0 gold finally made it possible.
:P

Great stuff.

Gonna uninstall 1.5.2 then install 1.5.3. I'll let you know how it goes.

EDIT

Installed successfully. Need to give it a test ride for a few days.  :D

Great mod...thank you very much !

The mod just permitted a very dangerous looking bot. For now, I banned the bot using my .htaccess file.

Interesting.  Still waiting for info on that bot...  But at least it will not be able to see anything in the suspicious BBC tags.

I also remember seeing that same bot in the denied list yesterday, but I can't seem to find it now. Strange.

Anyway, I recently almost got blocked by my ForumFirewall. The log said I was attempting to hack my custom theme's image folder. I fixed it by re-installing ForumFirewall onto my forum and custom theme. This may or may not be the right place to say it, but the email address I saw on the warning page looks way to confusing, and ugly for humans to interpret. Wouldn't it be possible to use Javascript to cloak the email address? Project Honey Pot (http://www.projecthoneypot.org/how_to_avoid_spambots_3.php) seems to think so. With Javascript the email address looks just like an email address, yet bots haven't been programmed to read it (nor any other javascript).

Funny, I just read that yesterday.  If you read that thread Java is not supported by all browsers.  I need to make the mod compatible with many people or they will complain.  What I do it a little more harder to beat than what they call "Advanced Munging" so I expect greater than 85% bots stopped.

Quote from: butchs on July 28, 2011, 05:23:53 AM
Funny, I just read that yesterday.  If you read that thread Java is not supported by all browsers.  I need to make the mod compatible with many people or they will complain.  What I do it a little more harder to beat than what they call "Advanced Munging" so I expect greater than 85% bots stopped.

Well, you won't find a one-size-fits-all solution, but it would be nice if users could choose the size that fits them. In other words, having javascript, images, and munging as obscuring options would be nice. And, newer browsers DO support Java afaik.

Also, some forum's only attract technical users who run the latest open source browsers.

Every other version of BB replaces "@" and "." with a special string.  As I said what the mod dees is far more advanced than what they call mugging.  It is so unique that it should be more effective than a published java script.  If you do not believe me then go with the java.

You have my permission to post an image or Javascript instead of my code.  Open banned.inc and replace "<?php echo bb2_email_scramble(); ?>" with the code you get from the link.
:)

SUSPICIOUS BBC TAG HELP - Only for SMF 2.0 Gold.

This feature is intended to provide additional security when posting an email address, phone number, personnel information and/ or a special forum event...

Attached is the BBC image created exclusively for the SMF 2.0 version of the mod.  The image is available when you post or modify a message.  The image will enclose the content in "suspicious" tags.  All content will NOT be viewable by any visitor in the "PERMITTED ENTRIES LOG".

There is am image of the BBC location on the mod (http://custom.simplemachines.org/mods/index.php?mod=2502) page.

There are two methods for a visitor to gain access to the "PERMITTED ENTRIES LOG" log:

• Visitors deemed suspicious by the core Bad Behavior package.
• If Project Honeypot is enabled, visitors who are below the minimum threat and age levels have been identified as suspicious or malicious by Project Honey Pot (http://www.projecthoneypot.org/services_overview.php).

httpBL Example:
Assume the following settings are in "Bad Behavior Admin/ SETTINGS/ Project Honey Pot HTTP Blacklist":

     Minimum Threat Level:    25
     Maximum Age of Data:    30

The mod will check the Project Honeypot Database:

• If the visitor has a threat level greater than 25 and has had bad activity in the past 30 days it will be blocked by the mod.
• If the visitor has a threat level less than 25 or has not had bad activity in the past 30 days but has been flagged as suspicious by httpBL then it will be placed in the "PERMITTED ENTRIES LOG".
• If the visitor is not in the httpBL database nothing will happen.

What happens when a visitor is deemed suspicious?

• Visitor is NOT blocked.
• If logging is enabled, the Visitor is placed in the visitor log.
• If the visitors is a guest and the "suspicious" BBC tags are used the content enclosed will not be visible to the visitor.
• If the visitors is logged in and the "suspicious" BBC tags are used the content enclosed will be visible to the visitor.
• If the visitors is a member via SMF and the "suspicious" BBC tags are used the content enclosed will be visible to the member.

CONCLUSION:
Only guests who are suspicious will not see the content enclosed in the BBC tags.

Enjoy.   :)

I'm running into an odd error when trying to install the Bad Behavior 1.5.3 package on SMF 2.0 RC3...

• Uploading the Bad_Behavior_1.5.3.zip package is successful
• Clicking the [ Install Mod ] link shows all 'Execute Modification' tests to be successful
• I added the "SetEnv TZ America/Denver" line to the .htaccess file in our server's document root
• When I click the blue "Install Now" button at the bottom, it takes me to the following URL, then the page blanks out and goes nowhere.
  
  my.web.site/user-forum/index.php?action=admin;area=packages;sa=install2;package=Bad_Behavior_1.5.3.zip;pid=0
  
  Nothing appears in the source code of the blank page, and when I reload, I'm presented with the following message:
  
  An Error Has Occurred!
  Your session timed out while posting. Please go back and try again.

I can install/uninstall other packages without issue, but this one seems to be giving me troubles.

Any ideas or suggestions would be very sincerely appreciated!

Quote from: mediaworksmt on August 03, 2011, 12:52:43 PM
Your session timed out while posting. Please go back and try again.

Guess 1:  I only see that message when my cookies are off.

Guess 2:  Maybe you should edit the htaccess after mod installation?

Guess 3:  you have have to manually adjust the permissions for the bad behavior folder.

Butchs

I use a broadband usb dongle (flashkey) where everytime I log onto the internet a new number is used.

Would my logging into the forum be affected by the mod?

butchs,

Thanks for your reply - After trying all of your suggestions, including a number of different variations of permissions, I finally noticed that an error_log file was being produced when I try to enable the package. Here's the information from it:

PHP Fatal error:  Call to undefined function  add_integration_function() in /public_html/user-forum/Packages/temp/install_db.php on line 66

Any further suggestions? I again really, REALLY appreciate your help - Thanks again!

edit: Looks like I may have found my answer in another thread (http://www.simplemachines.org/community/index.php?topic=334955.1060) - It seems add_integration_function() doesn't exist in 2.0 RC3, but was added in 2.0 RC4. Going to try upgrading to the latest SMF version and will let you know how things turn out.

edit2: Successfully upgraded to 2.0 RC5, and the "Bad Behavior" package now works like a charm! :-)

Yea, sounds probable, I keep writing it for the latest versions.    :P

Quote from: Brack1 on August 03, 2011, 08:20:51 PM
Butchs

I use a broadband usb dongle (flashkey) where everytime I log onto the internet a new number is used.

Would my logging into the forum be affected by the mod?

I do not know.  Try accessing into the Bad behavior (http://bad-behavior.ioerror.us/) home site as a test.
If you can get on there you are okie dokie.  :)

Nice mod.

Works perfectly without any issues.

Help me bro.
I activated honeypot.

In the fourth step of installation i got somelinks from projecthoneypot and they recommend me to include the link in my honeypot page.

I dont know where to include or adding those links in my smf forum.

Plz tell me where can i add these links.

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]"><!-- wildlife --></a>

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]"><img src="wildlife.gif" height="1" width="1" border="0"></a>

<a href="hxxp:mydomain.com/myhoneypot.php [nonactive]" style="display: none;">wildlife</a>

Etc...

Help me. Where can i add or include these links.

Thanking you all.

Just add "hxxp:mydomain.com/myhoneypot.php" to "Honeypot Link" and "wildlife" to "Honeypot Link word" in the mods admin page.  The mod will do the rest for you.

Thanks you very much butchs.

You are the saviour of SMF.

wish you all the best.

Now everything is fine.

God Bless You

How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.

Quote from: Brack1 on August 13, 2011, 07:14:49 PM
How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.

Bad behavior image?

By the way butchs, does that Honeypot keyword actually do anything?

Quote from: MiY4Gi on August 13, 2011, 07:41:59 PM

Quote from: Brack1 on August 13, 2011, 07:14:49 PM
How do I add the bad behaviour image to the bottom of the forum?

I had a go but kept being given an error.

Bad behavior image?

By the way butchs, does that Honeypot keyword actually do anything?

The one on the first post of the mods topic which many forums using this have displayed.

Quote from: Brack1 on August 13, 2011, 07:14:49 PM
How do I add the bad behaviour image to the bottom of the forum?

Instructions are here (http://custom.simplemachines.org/mods/index.php?mod=2502).

Quote from: MiY4Gi on August 13, 2011, 07:41:59 PM
By the way butchs, does that Honeypot keyword actually do anything?

Yea, it is a word that attracts a click.  Pick a good one.

The link requires "http:://bla bla..."

I am testing complete httpBL validation for the next release.

I did that and still had the error.

Which is the image link?

Error?  You did not detail an error.   ::)

The image file is here (http://bad-behavior.ioerror.us/images/bad-behavior-80x15.png).  You will need to download it and copy it on your server to a location you can pull it form then change the link to the image.
:)

Throw a bucket of cold water over me.

The error was an unknown < on line 510 (ish).
As for the image link.

I think I gotcha. I keep all my images on photobucket.

You may want to keep this one in your root directory.  Not everyone can read photobucket images.  Photobucket is blocked by some secure servers.

FYI - When I post images and etc to my site I enclose them with the suspicious BBC codes from the mod.  Then the bad guys will not be able to mess with them.
O:)

The mod is working perfectly.

Within two minutes of installing there were two blocked attempts.

This now stands at 36.

New Version:
Fixed integration bug with old SMF version - thanks mediaworksmt
Complete http:BL & BB installation validation - Now all project honeypot input data is checked
Bad Behavior 2.1.14 update - ???

Ya mean I shoulda waited 24 hours.

:o

Is it the usual uninstall or not a complete one?

Is that update critical? I don't feel like updating it if there's hardly any benefit.

Quote from: Brack1 on August 14, 2011, 05:23:05 PM
Is it the usual uninstall or not a complete one?

Sorry I did not know that the Bad behavior author was going to publish an update today.

Not sure of the changes to the core but i think it has something to do with good bots.

Quote from: MiY4Gi on August 14, 2011, 05:47:37 PM
Is that update critical? I don't feel like updating it if there's hardly any benefit.

Not sure.  The stuff I did is not critical.  It is just more user friendly. 12 vs 24 hr time display and validation checks of inputs.

But I am waiting for the list of changes to the core.  I am sure it can wait a week?

Can I clear out the 'log_badbehavior' table as its taking up a lot of space? I tried running the two scheduled tasks but they didn't seem to do much if anything?

The scheduled tasks are for daily cache purging and weekly log purging.

The log table automatically deletes it's self every week.

The mod will still protect your site if you turn off "Logging".  Logging is basically useful for testing.  Once you know it is working turn it off and in 7 days  the 'log_badbehavior' table will empty it's self.


EDIT:  I meant cache purging.

Quote from: butchs on August 28, 2011, 10:41:54 AM
The scheduled tasks are for daily cookie purging and weekly log purging.

The log table automatically deletes it's self every week.

The mod will still protect your site if you turn off "Logging".  Logging is basically useful for testing.  Once you know it is working turn it off and in 7 days  the 'log_badbehavior' table will empty it's self.

Nice one Butchs, thanks for the help again.

You are welcome.    :)

Contrary to popular belief, I thought of many scenarios for this mod...   :o ???

I should let you know that, if you turn off logging you should also turn off "Display statistics" because the statistics only works when logging is ON.  With logging OFF, "Display statistics" will no longer count the bad guy hits and will provide an incorrect lower count.

Same is true for my other mod...

If for some reason, you feel the mod is not working change your UA as described in "to test" in the first post of this thread...

Project Honey Pot is offline!

from 2 days.

it is not. it is working, also yesterday it was available.
my connection with HoneyPot is perfect.

Really nothing we can do.  I noticed it has been up and down lately.

Not a big deal since the mod protects you via other means...

Good mod! How do I whitelist an IP address with this mod?

ADVANCED WHITELIST HELP
In SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

This tutor details advanced whitelisting methods that allow you to whitelist just about anything else in "Bad Behavior Admin/ SETTINGS/ Whitelist".  this feature is typically used to whitlist the administrators IP (optional) and for PayPal (http://www.simplemachines.org/community/index.php?topic=375980.msg3152326#msg3152326) and OpenID (http://www.simplemachines.org/community/index.php?topic=375980.msg3152400#msg3152400) functionality.

Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should!

"Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address":

• IP address or CIDR format address ranges to be whitelisted (one per line)

The only recommended whitelist address are:

• The administrators IP address (optional - not required)
• Digg:

64.191.203.0/24
208.67.217.130

WARNING:  The following RFC 1918 IP addressees are standard with the core Bad Behavior package and are NOT recommended for SMF.  The reason is that SMF will not work if you have the forum set up to use a RFC 1918 IP (private IP).  SMF will only work with using an external static IP or domain name:
   10.0.0.0/8
   172.16.0.0/12
   192.168.0.0/16

"Bad Behavior Admin/ SETTINGS/ Whitelist/ URL":

• URL fragments beginning with the / after your web site hostname (one per line)
• URLs are matched from the first / after the server name up to, but not including, the ? (if any). The URL to be whitelisted is a URL on YOUR site. A partial URL match is permitted, so URL whitelist entries should be as specific as possible, but no more specific than necessary. For instance,

/example        would match "/example.php" and "/example/address".

"Bad Behavior Admin/ SETTINGS/ Whitelist/ User Agent":

• User agent strings to be whitelisted (one per line)
• User agents are matched by exact match only.
• Example

Mozilla/4.0 (It's me, let me in)


WARNING: The core Bad Behavior package uses an emergency back door User Agent "Mozilla/4.0 (It's me, let me in)" that has been removed from the SMF version because it can be exploited.

O:)

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.

since i installed this mod, paid subscriptions doesnt work. its blocked somehow. can you tell me how to fix it?

error code 403 Forbidden (from IPN History)

You posted this in another thread.  Taking a shotgun approach to get support is frowned upon here.

Quote from: maxtor on September 03, 2011, 04:38:39 AM
I have enabled paid subscriptions, and after i installed these 2 mods:

Mod Name: Bad Behavior mod
http://custom.simplemachines.org/mods/index.php?mod=2502

Mod Name: httpBL
http://custom.simplemachines.org/mods/index.php?mod=2155

paid subscriptions are failing with error code 403 Forbidden (from IPN History)

Code Select Expand

Notification URL: http://maxcheaters.com/forum/subscriptions.php

HTTP response code: 403

Delivery status: Failed

No. of retries: 16

This mod has nothing to do without outgoing traffic.  Delivery status looks like something to do with your subscription configuration.

That being said...  Not sure how subscriptions works but there is a option in this mod called "Offsite Forms".

Allow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.

If you still have issues you can place the ip address of your service in the whitelist (see a few posts back).
8)

Lastly, it could be that other mod.  The SMF 2 code is based off a beta version and has little SMF 2x support.   Try enabling the Project Honeypot feature in Bad Behavior instead.   :o

Quote from: butchs on September 03, 2011, 08:09:03 AM

This mod has nothing to do without outgoing traffic.  Delivery status looks like something to do with your subscription configuration.

subscriptions were working 3 years now. 1.x and 2.x versions.

Quote from: butchs on September 03, 2011, 08:09:03 AM
That being said...  Not sure how subscriptions works but there is a option in this mod called "Offsite Forms".

Allow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.

let me try this and inform you.

Quote from: butchs on September 03, 2011, 08:09:03 AM
If you still have issues you can place the ip address of your service in the whitelist (see a few posts back).
8)

Lastly, it could be that other mod.  The SMF 2 code is based off a beta version and has little SMF 2x support.   Try enabling the Project Honeypot feature in Bad Behavior instead.   :o

ip address of my service? where is that on paypal?

i dont think its httbl, this is only for spamers.

USING PAYPAL HELP
(other payment services may be similar)

Quote from: Core Engine AuthorDue to ongoing issues with various web services such as OpenID and PayPal IPN behaving in strange ways which trigger Bad Behavior, a new whitelist has been added. You may now add URLs of your site to Bad Behavior's whitelist. When a URL is added, Bad Behavior will ignore any HTTP request to that particular URL. If you need this feature, please check the bad-behavior/whitelist.inc.php file for further information. This feature was driven largely by the PayPal IPN web service, which sends POST requests with no User-Agent string, a common indicator of malicious activity. PayPal has refused to add a User-Agent string for years and has never given a reason, good or bad, for not including it. Reports from PayPal merchants who have contacted me indicate that PayPal is finally considering adding a User-Agent string to IPN requests; interested merchants should contact PayPal to express their support for this feature.

By default, Bad Behaviour blocks calls from payment services like PayPal's IPN, meaning subscriptions won't get told when a valid payment has been made. This blocking applies to any automated payment notification, as well as calls by subscriptions itself.

Until PayPal IPN clears up its POST requests it is recommended that you whitelist all IPN related addresses in this link.  Remember to place ";" before comment lines.

Here is an example of changes you can make to "Bad Behavior Admin/ SETTINGS/ Whitelist/ IP Address":
; IP address for PayPal servers
;------------notify.paypal.com(IPN)------------
216.113.188.202
216.113.188.203
216.113.188.204
66.211.170.66

; Starting September 29, 2011 www.paypal.com will be hosted by Akamai.
;------------ipnpb.paypal.com------------

64.4.240.0/20
66.211.160.0/19
216.113.160.0/19
173.0.80.0/20

; Additional IP addresses starting Q1 2012:
118.214.15.186
118.215.103.186
118.215.119.186
118.215.127.186
118.215.15.186
118.215.151.186
118.215.159.186
118.215.167.186
118.215.199.186
118.215.207.186
118.215.215.186
118.215.231.186
118.215.255.186
118.215.39.186
118.215.63.186
118.215.7.186
118.215.79.186
118.215.87.186
118.215.95.186
202.43.63.186
69.92.31.186
72.247.111.186
88.221.43.186
92.122.143.186
92.123.151.186
92.123.159.186
92.123.163.186
92.123.167.186
92.123.179.186
92.123.183.186
92.123.199.186
92.123.203.186
92.123.207.186
92.123.211.186
92.123.215.186
92.123.219.186
92.123.247.186
92.123.255.186
95.100.31.186
96.16.199.186
96.16.23.186
96.16.247.186
96.16.255.186
96.16.39.186
96.16.55.186
96.17.47.186
96.6.239.186
96.6.79.186
96.7.175.186
96.7.191.186
96.7.199.186
96.7.231.186
96.7.247.186

It is the responsibility of the admin to insure that the addresses are up to date.

It is also advised to whitelist the php file that communicates with paypal.

For example in "Bad Behavior Admin/ SETTINGS/ Whitelist/ URL:
/subscriptions.php
/Sources/Subscriptions-PayPal.php

ref

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.

USING OpenID HELP

Offsite Forms must be checked for openID in the bad Behavior admin panel.

Quote from: Core Engine AuthorAllow Offsite Forms (default false):
Bad Behavior normally prevents your site from receiving data posted from forms on other web sites. This prevents spammers from, e.g., using a Google cached version of your web site to send you spam. However, some web applications such as OpenID require that your site be able to receive form data in this way. If you are running OpenID, enable this option.

The OpenID server must be added to the Bad Behavior  whitelist.

For example, make the following changes in "Bad Behavior Admin/ SETTINGS/ Whitelist/ URL":
/Sources/Subs-OpenID.php

ref

EDIT:  Moved whitelist to the admin panel in version 1.5.10 - All the information that was once in whitelist.ini in now in "Bad Behavior Admin/ SETTINGS/ Whitelist"  Obsoleted information removed.

after adding these lines at whitelist i got this from paypal IPN history (today)


Date/time created: 9/4/2011 08:16 PDT

Original/Resent: Original

Latest delivery attempt date/time: 9/4/2011 09:42 PDT

Notification URL: http://maxcheaters.com/forum/subscriptions.php

HTTP response code: 403

Delivery status: Retrying

No. of retries: 10

so its failed again.

It has been working for others for quite some time.  Look at the reference on the bottom. 

Your url should be:

/forum/subscriptions.php

I do not know what else to tell you...

http://img6.imageshack.us/img6/2713/bad1b.png
http://img269.imageshack.us/img269/8343/bad2u.png

check this and tell me what is wrong.

Looks correct and the ip range is whitelisted on my 2.0 Gold test server.

Could be the forum, server or bad behavior cache not resetting.

If you have cloudflare purge it.
If you uninstall and reinstall a mod the forum disc cache will reset.
Not sure how to reset server specific cache -  You will need to consult your host or look it up.
;)

Quote from: butchs on September 04, 2011, 02:58:27 PM
Looks correct and the ip range is whitelisted on my 2.0 Gold test server.

Could be the forum, server or bad behavior cache not resetting.

If you have cloudflare purge it.
If you uninstall and reinstall a mod the forum disc cache will reset.
Not sure how to reset server specific cache -  You will need to consult your host or look it up.
;)

maybe conflicts with nginx?

Naw, Cloudflare uses nginx (as other tested servers) and it works with that.  CF uses ngnix as a front end caching proxy.  When changes are made the cache has to be purged.

Did you purge the cache on your server?

I believe there is be an accelerator that is keeping stuff in memory.

2) Try to copy your whitelist into the Sources/bad-behavior directory of the mod zip file and reinstall?

EDIT:  I was able to duplicate your error.  Item 2 fixed it on my test server with 64M Zend Engine v2.3.0  & XCache v1.3.0 enabled.

So much for taking off until November...

First time SMF user: long time phpBB user.

SMF 2.0.1 via softaculous (as I do not have time to manually manage all things interweb)

I had difficulty installing this mod. 

(1) fail

The integrated package browser would not play well.

(2) fail

browsing this sites mod listings for 2.0.1 compatible entries I copied the URL of the larger zip file to the package uploader of my SMF instance, upload, repeat for smaller file.  But SMF complained that the second file (~15kB was empty).  I tried copy/paste in reverse order (small then large zip file).  File not found complaints.

(3) win

Once I FTP'd the two files into ./Packages, returned to 'Browse packages', and clicked 'install' for BadBehavior was I permitted to proceed

Proposed installation seems good with either 'test successful' or 'file skipped' :: no failures in red listed.

"congratulations"

----

I appreciate the time you have invested in this mod but hope other people can overcome the manual requirements.


cheers

???   Must be some odd configuration of your host.

The mod installed just fine for me, using the package manager.....

The package was re-uploaded with a fix to the spanish translation.

My appologies if this has already been discussed, but I searched and didn't see it.  Every once in a while I get the following image in the top left corner and white space across the top of my screen.  Everything installed correctly with the theme so I'm not sure what's wrong.

The image is a link to the worm.php file.

Click on the "?" for help in the admin panel.

That is your and the honeypot spam trap and "worm.php" is the Honeypot Link you entered in the admin panel.

The mod generates several random spam traps that are used to lure in the bad guys.  Select "Limit honeypot on forum" to make the trap unnoticeable and simple.

Excellent, thank you!

is this mod the same of HTTP:BL mod?

what are their differences?

wich one is better?

Come on...  This mod has project honeypot and the bad behavior engine.  It does more.

how it does more?

HTTP:BL uses ProjectHoneyPot too..

so they use the same data base, what do you mean "BadBehavior does more"?

This mod does BOTH the bad behavior addition PLUS the HttpBL addition.

See the first post for more info on the "bad behavior addition".

Hello,

OK most of you will probably laugh at this one.. but
I am at the end of my nerves.. where will I see/find
the admin section for Bad Behavior?

I follow instructions for installation, did not give me
any error messages, but now have no admin options
in my admin section :(

Sincerely
Carola

Admin > Configuration

Guess that means it did not install :(

As I don't have that option in my admin (see picture)

You have to manually copy theme files or do a manual install for a custom theme.

for SMF 2.0 Try:
      copying "BadBehavior_Admin.template.php" to the "$themedir"
      copying "BadBehavior.english.php" to the "$languagedir"
      copying "badbehavior_bbc.gif" to the "$imagesdir/bbc"
      copying "badbehavior.css" to the "$themedir/css"

Otherwise you will need to do a manual install.

I use 2.0.1

Copying files did not work.. so looks like
I will have to do a manual install.. and
that will just have to wait for now.. but
many thanks Butchs for your reply :)

Sincerely
Carola

New version.  Some minor fixes and an attempt to fix the SMF 1.1.x DB errors.

New 2.1.15 core... New in this release (since 2.1.13):

• A version 2.1.14 was pushed to WordPress users without notice or announcement. While the software is in release candidate status, it should have had a prior announcement and documentation for the large number of changes from 2.0. Please accept my apologies for any inconvenience. Full documentation is forthcoming.
• New IP address ranges for Google and Yahoo!, which were previously unused for crawling, have been added to Bad Behavior.
• Once a request is determined to be from a search engine, all further checks are skipped.
• Requests from Internet Explorer 6 which are blocked due to a long standing bug in that browser are now blocked only when Bad Behavior is in strict mode. (Users of IE6 should make plans to upgrade as soon as possible, and should have done so years ago.)
• WordPress only: A bug in the built-in log viewer causing the wrong requests to be shown in some circumstances has been fixed.
• WordPress only: Calls to some deprecated WordPress functions have been rewritten.
• The URL whitelisting feature now accepts partial URL matches. This was necessary for compatibility with certain shopping cart plugins.

Remember to back-up any custom "whitelist.ini" files you may have created...

i installed Bad Behavior on my forum.  When I look at the files that it installed via ftp versus the files that I unpacked on my own computer, they are significantly different.  Can I use ftp to copy all the files up to the Bad Behavior Mod folder?  I do have a couple of custom themes that need to be dealt with manually, but the files that I need to do that with, did not get uploaded to my server when I did the install through the package manager.

Should I uninstall the mod before uploading the files, if that is what I am supposed to do?  If I do uninstall the mod, will it show up via the installed packages, if I just upload the files manually?

It is also asking me for an alpha key that I can't find.  I did receive a key from honey pot but it is all numbers.  Can someone tell me where this alpha key can be found?

Thanks in advance.

No.  There is a set of files for SMF 1.1.x and a different set of files for SMF 2.0.x.  The mod installs the correct files automatically.  Look at package manager for the correct files for your version of SMF.

Project honeypot Access Keys (http://www.projecthoneypot.org/httpbl_api.php) are 12-alpha characters (no numbers).   If you see this "You must enter a valid Project Honey Pot http:BL Key, which can only be exactly 12 alphabetic characters. (no numbers or symbols) Leave the field blank to disable this function" then you need to correct the "http:BL Access Key" in the admin panel.

Request an access key here (http://www.projecthoneypot.org/httpbl_configure.php).

edit 10/24- added link to access key

One of my user got denied by BadBehavior posting in a topic he has previously posted in fine because of this reason: "POST more than two days after GET".
What does that mean?

He tried deleting cookies/emptying cache but it didn't work.
He can post in other topics fine.

I'm running SMF 2 et BadBehavior 1.5.3

Thank for any help or pointers!

Bad Behavior was developed for a content manager.  One of its features is to check for suspicious activity via BB's javascript/ cookie to test post and get in a form.

"POST more than two days after GET" means that the request dates and times in a form entry do not match. This could indicate the use of a proxy which corrupts the HTTP headers of the request, causing Bad Behavior to trigger.

As far as I know both post and get are not used in SMF unless your site is connected to some sort of offsite Form.

Possible solutions:
1.  If you are using offsite forms in your site enable that feature in your admin panel.
2.  Ask him to try to enable cookies or Javascript and see if it goes away.
3.  He may have a bad proxy.
4.  He may have a trojan on his computer.
5.  Someone may have created a post on your site that links to an offsite form.  Maybe a click scam or an information collector.  Do you know which thread it is?  If so can you you go to phpmyadmin, copy the data and attach it as a text file here?

Thanks butchs. :) Got the key and the mod is running just fine on my forum now.

You are welcome.

I have an odd occurrence that is my fault for not paying attention.  The last mod I installed was the latest upgrade to this mod.  Since then, I cannot install or uninstall any mods.  If my feeble memory is jogged enough,I seem to recall something at the end of installation that said that some files attributes were changed at the end and to tick a box to revert them back to ?.  But, as I looked up to see that and tick the box, the screen went away too fast and went back to the package manager.

I hope I am thinking of the right mod, but can anyone tell me what the message said and how I can get the files back to their former attributes?  Thanks for helping!

You mean this from the readme?

During installation of SMF 2.0x and or at a later date, SMF may ask to "Restore File Permissions" for "banned.inc.php".  Do not make any changes!

Something also involved a checkbox at the end.  I may have the wrong mod.  Something is funky since I cannot install or uninstall anything right now.  I haven't changed anything in quite some time. 

To prevent issues this mod disables it's self when uninstalled.  You have to enable it via the check box before it is active again.  If you never enabled it then your issue most likely lies in something you did or elsewhere.

Well, I assumed it was active and when I tried to go into the Bad Behavior section to look, I got a white screen, the same as I get when trying to install or uninstall a mod.  Curious.

Maybe you did a double installation of a mod?  If you remember what mod you were last playing with you can try to uninstall it twice via package manager.  The first time takes a click.  To do it the second time you will have to copy the original mods zip file to the "Packages" directory via ftp before going back to package manager.  If it was installed twice it will show up on the list.

Though I am giving you a possible path forward, support for the above type of error is out of the scope of this thread.  I am sure this topic has been covered in detail elsewhere in this site.

The last mod installed was Bad_Behavior_1.5.6.zip on 10/31/11.  There is only one copy of it.  I cannot get into the settings area of this mod to see that it is active or inactive.  I now recall that I had an issue with it when I installed it but was taken away and never returned to the issue.  That is why I am here now.

I need details to exactly what you did.  It is impossible for me to read your mind through my computer and guess your version of SMF, theme, and or anything else you have done.

The mod has been installed on thousands of forums without issue.  So my first guess is you made an error by accidently performing a double installation of the mod (read the instructions in the last post), which is human not mod error since this can be done with any mod

Now if you performed a double installation and do not have access to package manager you will have to manually uninstall the mod.

Or have a custom theme that requires manual installation or un-installation of the mod.  As stated way back the mod support is for the default theme only.  I do not have the time to create code for every custom theme.

If you have a custom theme maybe you need to copy the language files over to the theme???

Been probing the internet to see if my SMF mod is doing any good.  I found several SMF sites:

• Bad Behavior has blocked 4568 access attempts in the last 7 days.
• Bad Behavior has blocked 1389 access attempts in the last 7 days.
• Bad Behavior has blocked 1046 access attempts in the last 7 days.
• Bad Behavior has blocked 3008 access attempts in the last 7 days.
• Bad Behavior has blocked 560 access attempts in the last 7 days.

I am sure there are many more.  These high numbers are telling me I need to add a DB count reset in the next version...

I extend my thanks to all who use this mod!  I am happy to see my work has given such results!
:)

This mod LOOKS great and shoudl be the answer to my Cloudflare issues as well as spam, but -- I wasn't able to install it automatically onto SMF 2, and when I tried manual installation all worked well except I could not run install_db.php. When I try, I get "Admin priveleges required." but I have NO idea how to set them up ... any help?

It works well with Cloudflare.

You can download my unofficial Cloudflare mod here (http://www.simplemachines.org/community/index.php?topic=391926.msg2726085#msg2726085).

Try the attached install_db file.  I will delete the attachment in 1 day.

New version.  Added more security due to bots probing for vulnerabilities.  Thank you MissileShooter for pointing out some errors in the SMF log...
:)

I am having some trouble with this mod. I have installed and configured Bad Behavior, but it is showing "Project Honeypot Offline"

I am fairly certain that this is not a matter of the Project Honeypot site being offline, because I have another site running httpBL that shows a good connection.  I have included my list of installed mods, to see if there may be some compatibility issues. 

I am using v1.5.7, have double check my API key, script installation, linking, and keyword, but I continue to get the error.



Any ideas?

The Project HoneyPot test offered at the Project HoneyPot site (as used in many other mods) always shows it to be online.  This is not true!  The test this mod performs is unique and is extremely accurate.  I went through great pains to insure accuracy.

At this moment "Project Honeypot Offline" is true.  I tested it at my site.  The web page may be up but the service is not proving test results.  Probably updating the database...  Give them a few hours and they will most likely be beck in service.

The beauty of Bad Behavior is that it still protects your site when Project HoneyPot is down through it's own tests.

Quote from: butchs on December 19, 2011, 11:35:41 AM
The Project HoneyPot test offered at the Project HoneyPot site (as used in many other mods) always shows it to be online.  This is not true!  The test this mod performs is unique and is extremely accurate.  I went through great pains to insure accuracy.

Fascinating! Kudos for that! It's somewhat disappointing that they use an inaccurate method to test the availability of their services. butchs for president?

Every time I try to install this mod my file permissions change on my home dir, causing my to get error 500 on all my sites not just this one. I know it is something to do with my host, but is there anything I could suggest they change to allow me to install this? I guess I could also install it manually.

You could always go back to cpanel's file manager and change the permissions manually. 

I have to do the same for my web site because when I install mods the permissions end up as 666 so I manually change them to something more secure.

So I installed the mod, I had to create a temp folder to get past some chmod settings, but that was easy.

Apparently I either missed a step or I am just missing something. But I don't see the mod under any drop down menus. Where is it located in the administration?  :'(

Under admin/ Configuration.  Maybe the mod's language files are not in the language directory?

Quote from: butchs on December 21, 2011, 08:13:31 AM
Under admin/ Configuration.  Maybe the mod's language files are not in the language directory?

I thought of that so I manually uploaded the files to my language directory. Didn't fix. Uninstalled and installed the package again, and I get this error.


Fatal error: require_once() [function.require]: Failed opening required '/home/kotsadmin/thekots.com/Sources/bad-behavior/bad-behavior/functions.inc.php' (include_path='.:/usr/local/lib/php:/usr/local/php5/lib/pear') in /home/kotsadmin/thekots.com/Sources/bad-behavior/bad-behavior/core.inc.php on line 11

Looked in the path, found out that functions.inc.php was not uploaded. I uploaded it, website is functional, but I am curious now if it installed correctly because the sources in the .zip has a TON of files, whereas in my FTP there are only five.

--Update: So everything seems to be working as far as the settings/honeypot goes. I have yet to do the fake/pseudo testing recommended but I will try doing that when I get enough time. The pure culprit of my error was that the sources directory didn't seem to upload properly. I don't know if this was because of having to create a packages/temp folder that kept deleting itself or what... but so far everything seems to be fine.

Since tests are performed on a need to know basis and if you do not have all the files a bad guy could get through.  I recommend to unzip the mod on my home computer and look at the changes in "package-info.xml".  depending on your version of SMF there are specific files that go into specific places.  Verify each file to insure they are all in the correct location.

quick question, I Run 2 forums, I have this installed in both, and it works great in both.

But one forum shows the display just above the load time for how many bad ips ive got within 7 days

the other does not, the code it there in the default, and in the custom theme files  , just above the load time code like its supposed to be   .. there is no reason it shouldnt be there, AND i have it selected in the admin to show it.

but its not showing... the mods working fine except for that....   

its not showing in the default and custom theme

Im running SMF 2.0.2 for both forums, the working forum is using the Darkmodern theme  the non working is using the Blue moonlight theme....

Maybe the following is not in index.template.php of the non-working theme:

if ($modSettings['badbehavior_display_stats']) {
if (!function_exists('bb2_insert_stats')) {
global $sourcedir;
require_once($sourcedir . '/bad-behavior/BadBehavior-SMF.php'); }

bb2_insert_stats();
}


You should also find in index.template.php:
// Bad Behavior Start
if (function_exists('bb2_insert_head')) {
  bb2_insert_head();
}
// Bad Behavior End


The mod may not load properly without the above.  You may want to review the code for that part of the installation.

both of those codes are exactly where they need to be in both the default, and blue moon themes index templates

Please post the index.template.php for the blue theme.

Hello. I've installed BB on my forum, installed a honeypot correctly, and put in my http:BL key. I keep getting the error saying that I must enter a valid Honey Pot Link Word URL or leave the field blank...and the field is blank. I've tried uninstalling/reinstalling the mod but it did not resolve this. How do you fix this? Thanks.

I had that problem to, when you go to honey pot get the quicklink, look in the quick link HTML on that page, along with the reoccuring honeypot link , you we see a word multipul times, for me it was like " longpoke " thats the Link word, so in the big honey pot area, you only need to add the quick link URL, not all that html they provide for you, then the link word is the random word reoccuring

here is an example

go to the honey pot site, click manage quick link

copy just your quick link into the Big BB link box  you dont need to copy all the code, only the url http://aatf.us/conditionalgrowing.php?rss=0793

then look to the embed code on the manage quick link page

<a href="http://aatf.us/conditionalgrowing.php?rss=0793"><!-- grany --></a> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><img src="grany.gif" height="1" width="1" border="0"></a>
<a href="http://aatf.us/conditionalgrowing.php?rss=0793" style="display: none;">grany</a> <div style="display: none;"><a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany</a></div> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"></a> <!-- <a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany
</a> --> <div style="position: absolute; top: -250px; left: -250px;"><a href="http://aatf.us/conditionalgrowing.php?rss=0793">grany</a></div> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><span style="display: none;">grany</span></a> <a href="http://aatf.us/conditionalgrowing.php?rss=0793"><div style="height: 0px; width: 0px;"></div></a>


notice the word " Grany " keeps poping up in the code, thats your Link word   

Quote from: butchs on December 30, 2011, 02:49:50 PM
Please post the index.template.php for the blue theme.

here you go  , thanks!!!!!! 

Quote from: mikedijital on December 30, 2011, 04:05:02 PM

Quote from: butchs on December 30, 2011, 02:49:50 PM
Please post the index.template.php for the blue theme.

here you go  , thanks!!!!!! 

Your problem is another mod is causing an error.  If I remove  ". get2by2host_copyright()"  the page loads correctly.

You know what when I installed that mod, I read the thread about it, and alot of people were complaining about that copyright being slammed at the bottom of the index template.

its for a menu buttons mod, and the complainers said the sneaky way they slid that in was bad

thanks, I love your mod   ive blocked 40 attempts in 4 days. and only 2 comment spammers got through!



I have on final question. if and when you make upgrades, do I clean uninstall the prev version, or do you give instructions on a update without a full  uninstall, I want to always keep this mod up to date


and finally, THANK YOU, none of the mod creators I ask questions to on this site reply..... like ever....   your the first one to give me 1 on 1 help, THANK YOU sooooo much!   and thats why your mod is awesome!

Quote from: butchs on December 31, 2011, 03:28:25 AM

Quote from: mikedijital on December 30, 2011, 04:05:02 PM

Quote from: butchs on December 30, 2011, 02:49:50 PM
Please post the index.template.php for the blue theme.

here you go  , thanks!!!!!! 

Your problem is another mod is causing an error.  If I remove  ". get2by2host_copyright()"  the page loads correctly.

I tried removing that line in both index templates ( default and theme )...  and still nothing

I have my cache turned off.  It worked for me...  Did you include the dot?

i zapped the dot with the code... whats weird is the forum that does have this working has the same "get2" code for that mod as well and works great

non working  www.paranormalpi.org    working  www.deggi5.com   

also could it be that there is noting in the permitted and not permitted logs yet?   on the site that its not working the logs are empty... ( its a fairly new site, the spammers havent found yet ) and the site it works on, gets bombed lol 51 denied attempts in the last 7 days


lemme give it a few days till I get at least 1 spammy in the denied log and see if that triggers the report to show

thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !

Mike as the 2by2hosts folks are not popular I would suggest you look elsewhere for a similar mod.

Look their name up using search.

Quote from: mikedijital on January 04, 2012, 05:30:31 PM
thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !

Thank you for providing an update.  Most people stop posting when their problem is resolved.

butchs my apologies for the hijack.

Quote from: butchs on January 04, 2012, 07:28:30 PM

Quote from: mikedijital on January 04, 2012, 05:30:31 PM
thats what it was, the display doesn't show up untill it has blocked at least 1 bad bot.....


GREAT MOD, its stopped my spam by 90%   177 bad  blocks in 7 days !

Thank you for providing an update.  Most people stop posting when their problem is resolved.

I love this mod, anything I can do to help because look  --->   " Bad Behavior has blocked 767 access attempts in the last 7 days  "     As you can see you have helped me VERY MUCH! lol     Cheers, and happy new year!

Hi butchs,

I currently have Bad Behavior showing up twice at the bottom of my forum.  (Why this happened?  My forum, which already included Bad Behavior, wasn't enabling me to post due to some conflict with a mod, so I reinstalled 2.0.2 and ran an upgrade, then reinstalled Bad Behavior).  Anyways, I'm guessing that modification is working but it just looks bad with two lines of text ... see attachment.

Is there some file to fix? 

Thanks,
pols1337

It has something to do with your index.template.php file.  Please attach a copy.

basically, the problem is that he reinstalled smf without UNinstalling the mod first....   and he's using a custom theme.

So, what that means is: when he reinstalled smf, he removed all traces of the mod from the core smf files, including the default/curve theme... but did not remove the mod code from any custom themes.
He then went and reinstalled the mod, and checked the boxes for "install into my custom themes", even though it was already installed into the custom themes....

So, every theme file edit that exists in the custom theme will be duplicated. The only VISIBLE one is the footer, but I guarantee that the additions higher in the index.template.php file were also duplicated.

Please see attached for index.template.php.

Not sure which one you need so I'm attaching all three: Astonished (custom theme), Core, and Default.

Quote from: Kindred on January 10, 2012, 06:43:17 PM
basically, the problem is that he reinstalled smf without UNinstalling the mod first....   and he's using a custom theme.

So, what that means is: when he reinstalled smf, he removed all traces of the mod from the core smf files, including the default/curve theme... but did not remove the mod code from any custom themes.
He then went and reinstalled the mod, and checked the boxes for "install into my custom themes", even though it was already installed into the custom themes....

So, every theme file edit that exists in the custom theme will be duplicated. The only VISIBLE one is the footer, but I guarantee that the additions higher in the index.template.php file were also duplicated.

That is what happened.  See the attached fix.

So just to confirm, there are no changes that need to be made to the Core and Default index.template.php? 

Does it work?

Yup it looks good.  Just wanted to confirm though.   :D

I used to get 3 spam bots a day, I havent got one since I installed this mod

THIS REALLY WORKS!!!!

From my site
"   Bad Behavior has blocked 2612 access attempts in the last 7 days. "


THANK YOU! 

Hi,
Is the BB_Language.zip required for this .Mod??

Quote from: Crip on January 13, 2012, 09:46:06 AM
Hi,
Is the BB_Language.zip required for this .Mod??

No.  It is an aid for would-be translators.

how can i allow an specific server access my smf using badbehavior?

its my own server for my other website, wich have to ping my smf forum wich uses badbehavior mod.

im getting error 403

QuoteBad Behavior - Event Details
ID:    4264
IP:    200.98.197.4
whl0056.whservidor.com
DATE:    2012-01-17 14:00:07
METHOD:    GET
URI:    /
PROTOCOL:    HTTP/1.0
HEADERS:    GET / HTTP/1.0 Host: www.detetiveweb.com.br User-Agent: Mozilla/5.0 (compatible; U; Linux i686; en-US) LinkDr/0.6.4 http://linkdr.net/ X-Forwarded-For: 200.98.197.4
AGENT:    Mozilla%2F5.0%20%28compatible%3B%20U%3B%20Linux%20i686%3B%20en-US%29%20LinkDr%2F0.6.4%20http%3A%2F%2Flinkdr.net%2F
ENTITY:    
KEY:    17566707
DENIED REASON:    Required header 'Accept' missing
EXPLANATION:    An invalid request was received from your browser. This may be caused by a malfunctioning proxy server or browser privacy software.
ERROR:    403

Hi,

I had this mod installed on my forum for ages and it was working perfect, but I uninstalled it a few minutes ago to reinstall it because I was getting a lot of spam members but when I reinstalled it I keep getting the following message on the top of my forum and all the fonts are huge and the forum doesn't look right.

// Bad Behavior Start $txt['permissionname_badbehavior_goodgroup'] = 'Bad Behavior Whitelist Group'; $txt['permissionhelp_badbehavior_goodgroup'] = 'This option will make a member group exempt from all Bad Behavior tests.'; // Bad Behavior End

Anyone know what might be causing this? My site is now on maintenance mode at the moment. If anyone could help me as soon as possible because I am getting a lot of message from members asking what wrong.

Thanks.

 look in your modifications.english.php


the text got added after the closing ?> somehow...   move the ?> to be the last thing in the file

Quote from: Kindred on January 17, 2012, 03:48:28 PM
look in your modifications.english.php


the text got added after the closing ?> somehow...   move the ?> to be the last thing in the file

Thank you very much Kindred you are a life saver.  :)

Quote from: frytec on January 17, 2012, 12:06:17 PM
how can i allow an specific server access my smf using badbehavior?

its my own server for my other website, wich have to ping my smf forum wich uses badbehavior mod.

im getting error 403

The instructions to whitelist ip's is here (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023).

Maybe I'm just idiot (a lot of my friends think so!), but I can't figure out how to get to the Bad Behavior Admin section  :-[

Just installed it (after seeking assistance when it wouldn't install, which I ended up having to create a "temp" folder in the Packages directory) and by all appearances, the install was a success.  But no where can I find a link to gain access to the Bad Behavior Admin section!

And there's nothing listed under Admin->Administration Center->Modification Settings->Miscellaneous.

Help?

Make sure the "BadBehavior.english.php" or other appropriate language file is installed in the language directory of your theme..
8)

Yes, it is there in the "default" theme (not in core, but there is only one language file in there "Settings.english.php").

Now what?

I have no idea if you are or are not using the default theme.  I assume you are using core.  If you are not using default then copy the "BadBehavior.english.php"  to the theme language folder you are using.

I am using the "default" theme.

Where should the Bad Behavior Admin page normally be found/accessed?

Admin/ Configuration/ Bad Behavior

Bump.

Okay, I forgot the "secret squirrel" handshake to get me access to the "secret admin section"  ;D

Is it really that hard to describe "go to this link, click on that button, select that option.... and voila!"?  It would really help me self troubleshoot to get an idea of the steps to invoke the Admin panel...

Click on Admin menu, then click on the Configuration menu then click on the Bad Behavior menu.

Support for the basic use of SMF is NOT part of this thread.  If that is what you need then go here (http://www.simplemachines.org/community/index.php?board=147.0).

Hey now, don't get all jumpy and nanny on me!

1) Your response did not show up after refreshing the thread over two days, but now suddenly I see a response before my bump.  I gave it plenty of time allowing for the fact that we are all busy and can't respond immediately to every question that arises.  Still scratching my head why I didn't see any responses before...

2) Trying to find the right forum for support for your mod or any mod is absolutely not specified anywhere!  Even on the download page here for your mod.  I tried searching for several days in between my attempts to self-troubleshoot.  So please, cut people some slack as there is no "standardized" method or FAQ on where to go for help.  And I'm certainly no a n00b on forums (though for SMF, yes).  Not only that, but this thread is apparently in regards to the BAD BEHAVIOR MOD, so how is anyone supposed to know that the issue I'm experiencing may potentially NOT specific to Bad Behavior but to SQL?  Seriously.

every mod distributed on our mod site has a support thread linked from the mod's download page....

What specifically do I need to do to make this error go away?:  Fatal error: require_once() [function.require]: Failed opening required '/hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Sources/bad-behavior/BadBehavior-SMF.php' (include_path='.:/usr/local/lib/php-5.2.17/lib/php') in /hermes/bosweb26b/b647/ipg.judithbarsicom/forum/Themes/pink-art/index.template.php on line 368

I am guessing here since I do not know what version SMF you have.  But here goes nothing:

1.  The path to "$sourcedir" is incorrect in "Settings.php".
2.  The correct version of "BadBehavior-SMF.php" is not located in your "/Sources/bad-behavior/" folder.  Check out "package-info.xml" for the proper location.
O:)

I have the latest, 2.0.2

Then I guessed correctly.  The second line in your "BadBehavior-SMF.php" file should not read "BadBehavior-SMF.php  - for SMF 1.1.x -  PHP template for Bad Behavior mod".  If so copy the other file (in the root zip folder) to your directory.

New version 1.5.8 with updated 2.2.1 core, changes are:

• Some additional known spammers have been identified and blocked.
  
• IPv6 support has been improved, including new support for IPv6 whitelisting.
  
• New configuration options are available for web sites running behind reverse proxies/load balancers and third party content distribution networks such as Akamai and CloudFlare. These options ensure that Bad Behavior can correctly screen requests when operating in these environments.
  
• Search engines are screened faster and more accurately, improving search engine metrics such as Google Page Speed and YSlow and virtually eliminating the possibility of false positives for search engines. (Bad Behavior still blocks most malicious traffic originating from search engine providers' networks.)
  
• Blackhole lists other than http:BL have been removed as unsuitable for sites running Bad Behavior. Because of its comment spammer tracking, http:BL remains the only blackhole list Bad Behavior uses. (It is disabled by default; enable it in your settings if you wish to use it.)
  
• Bad Behavior's whitelisting feature has been completely revamped. Whitelists are much easier to maintain.
  
• Across the board performance improvements have been added.
  
• Messaging displayed to blocked requests has been significantly improved for clarity and to facilitate issue resolution.
  
• On platforms where database logging is available, Bad Behavior would sometimes continue to log even when the logging setting was turned off. This has been fixed.
  
• When a site enabled the Reverse Proxy option when it was not actually needed, Bad Behavior would sometimes fail to acquire the correct IP address for incoming requests. Bad Behavior's code to detect this situation and acquire the correct IP address has been improved.
  
• Numerous additional minor improvements.
  
• Donation page updated to show support from SMF users.
  

Updated my live forum without any problems, Thanks.  :)

I just noticed I'm throwing these errors ....

Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

Type of error: Undefined
Undefined index: badbehavior_report_all_title
File: /Sources/Admin.php
Line: 213

Type of error: Undefined
Undefined index: badbehavior_settings_title
File: /Sources/Admin.php
Line: 212

Type of error: Undefined
Undefined index: badbehavior
File: /Sources/Admin.php
Line: 205

Type of error: Undefined
Undefined index: badbehavior_about_title
File: /Sources/Admin.php
Line: 216

Type of error: Undefined
Undefined index: badbehavior_report_denied_title
File: /Sources/Admin.php
Line: 215

Type of error: Undefined
Undefined index: badbehavior_report_permit_title
File: /Sources/Admin.php
Line: 214

All the errors are originating from the follow code;

// Bad Behavior Start
'badbehavior' => array(
'label' => $txt['badbehavior'],
'file' => 'BadBehavior-Admin.php',
'function' => 'badbehavior_admin_init',
'custom_url' => $scripturl . '?action=admin;area=badbehavior;sa=settings',
'permission' => array('admin_forum'),
'icon' => 'modifications.gif',
'subsections' => array(
'badbehavior_settings' => array($txt['badbehavior_settings_title']),
'report_all' => array($txt['badbehavior_report_all_title']),
'report_permit' => array($txt['badbehavior_report_permit_title']),
'report_denied' => array($txt['badbehavior_report_denied_title']),
'badbehavior_about' => array($txt['badbehavior_about_title']),
),
),
// Bad Behavior End


I guess you have a custom SMF 2.0.x theme and manually installed the mod? 

Check your index.php file and make sure the action array is defined:


// Bad Behavior Start
'badbehavior' => array('BadBehavior-SMF.php', 'badbehavior'),
// Bad Behavior End]
  :o

what that usually means is that a manual installation neglected to add the text strings to modifications.english.php (replace with your language instead of english)

I verified the correct coding is placed within the index.php and within modifications.english.php in both templates (default and custom). I'm still throwing the codes.

For this mod, the language information for the admin menus are stored in the "/languages/BadBehavior.english.php" (or another language) file of the theme directory and the help text is installed from "modification_language.xml".

Seeing how, for some reason, that made absolutely no sense to me ...
Can you please explain how to correct the errors? I followed the install instructions and even verified twice that the codings were present and correct.

If you want to get a good explanation you will need to put some effort in explaining your problem.  Instead of copying and pasting a long post with no details you could have provided basic informaiton like your SMF version and what you did.  I work long hours and only have a few minutes per day to provide this free support.  So far I guessed that you have SMF 2.0, you have a custom theme and you did not properly install the mod in the custom theme.  By the way I have stated many times that I provide support for the default theme not custom themes.  The above is the reason why.

Kindred said that this issue occurs when the text strings for the admin screen are missing.  He assumed that they are in modifications.english.php but for this mod they are in in other files.  You need to complete your manual installation and copy the language, css and all other files to the correct directories as per "package-info.xml" then make the changes in php as per "modification_language.xml".

There are on-line resources that read and provide a list of changes that need to be made for modifications.  I am sorry but I do not have a link.

Time is up, gotta go to work.

actually, the smf mod site has a mod parser for manual installations built in to the mod download page

I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

I don't know if this has anything to do with project Honeypot going down for a few days and my access key no longer works, or what. Any ideas wht it's not working?

At honeypot, it says access key is working.

Quote from: Xarcell on February 09, 2012, 12:10:36 PM
I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

It is common for the service to go up and down.  When it is up you will get
"2b021b1f" keys when a bad guy visits your site.  When it is down Bad behavior code protects you.  No matter what the results of the test are, the mod will try (when the cache expires) to access the project honey pot service.

As for the project honeypot web site, they are two different things.  The website can still be up while the database is being adjusted.

Unlike all other tests the mod does something no other project honeypot application does to insure that the test is accurate.  It took me some time for me to create the test but it has proven reliable. 
:D

Quote from: butchs on February 09, 2012, 07:48:58 PM

Quote from: Xarcell on February 09, 2012, 12:10:36 PM
I have install bad behavior. I have checked to enable it. I enter my http:BL Access Key(copied & pasted). However, it says "Project Honey Pot is offline!".

It is common for the service to go up and down.  When it is up you will get
"2b021b1f" keys when a bad guy visits your site.  When it is down Bad behavior code protects you.  No matter what the results of the test are, the mod will try (when the cache expires) to access the project honey pot service.

As for the project honeypot web site, they are two different things.  The website can still be up while the database is being adjusted.

Unlike all other tests the mod does something no other project honeypot application does to insure that the test is accurate.  It took me some time for me to create the test but it has proven reliable. 
:D

Yeah your right. It seems the service is up & down at times. Currently working...

Thanks.

Installed this today on my 2.0.2 and it went smooth as silk, no problems at all.

Thanks  8)

You are welcome.
:)

Hey maybe you can help, or at least tell me if I've missed something. I just installed the Bad Behaviour Mod however I now have this on the top of the screen:

Quote// Bad Behavior Start $txt['permissionname_badbehavior_goodgroup'] = 'Bad Behavior Whitelist Group'; $txt['permissionhelp_badbehavior_goodgroup'] = 'This option will make a member group exempt from all Bad Behavior tests.'; // Bad Behavior End

site is: http://dragonagerpg.amazeart.net/index.php?action=forum
Any help?

your installation was done incorrectly and added the txt strings AFTER the closing ?> in the language file.

Find the edited language file and move the ?> from where ever it is int he file to the very end...

Hello, butchs...

I currently use the following mods to stop spammers:

• httpBL (http://custom.simplemachines.org/mods/index.php?mod=2155)
• Stop Spammer (http://custom.simplemachines.org/mods/index.php?mod=1547)

Is there any particular reason for me to include your mod as additional protection?  Is there any known conflicts with your mod and the two I have already mentioned?

Thanks, in advance, for any info...

I am not incredibly tech-savvy, so I am having trouble figuring out how to run the test.

QuoteTo test:
To insure that Bad Behavior is functioning correctly you can add the sting "Bad Behavior Test" to the User Agent (UA) of a HTTP request from someone who is not in the whitelist and is not the administrator.

    * Windows use FireFox with the [nofollow]"Modify Headers"[/nofollow] add-on.
    * Macintosh, [nofollow]"enable the Develop menu"[/nofollow] in Safari.


If you look at the page source (just below the title) you will see the speed of this mod at work:  <!-- Bad Behavior 2.2.1 run time: 3.025 ms -->

So, I should get the add-on with firefox? Then do the test? And what is a sting? Where is the user agent? What is an http request? Where do I find the page source and title? 

I apologize if these are silly questions but I need help. Thank you in advance!

If I have data in the entries logs, does that mean it is working properly? I do have some data now, finally, and it seems to be working, altho it has let a couple spammers thru.

Quote from: GlitchPC on February 22, 2012, 01:20:47 AM
Hello, butchs...

I currently use the following mods to stop spammers:

• httpBL
• Stop Spammer

No conflicts.  BB does what httpBL does but adds BB protection when projecthoneypot is down.  Plus this mod is routinely updated for SMF.

Quote from: CDM on February 22, 2012, 02:31:30 AM
If I have data in the entries logs, does that mean it is working properly? I do have some data now, finally, and it seems to be working, altho it has let a couple spammers thru.

Yes it is working.

Sign up for projecthoneypot (http://www.projecthoneypot.org) and enter the "http:BL Access Key" in the admin page of the mod to block more spammmers.  Click "?" for help.

Quote from: butchs on February 22, 2012, 05:00:39 AM

Quote from: GlitchPC on February 22, 2012, 01:20:47 AM
Hello, butchs...

I currently use the following mods to stop spammers:

• httpBL
• Stop Spammer

No conflicts.  BB does what httpBL does but adds BB protection when projecthoneypot is down.  Plus this mod is routinely updated for SMF.

Thanks for the quick reply...

I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Any help?

Edit...

It seems to be working, now.  Logs are showing entries.  However, I do have an additional question...regarding the following statement...

QuoteIn SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

What happens for Opera Turbo users?  Turbo creates different IPs quite a bit.  Will a member get denied access simply because they use Opera with Turbo enabled?  If so...how does one go about rectifying this issue...since they will have a different IP every time they log into the forum?

Quote from: butchs on February 22, 2012, 05:01:40 AM

Yes it is working.

Sign up for projecthoneypot (http://www.projecthoneypot.org) and enter the "http:BL Access Key" in the admin page of the mod to block more spammmers.  Click "?" for help.

Thanks so much!! FAB mod!! ;D :laugh:

Quote from: GlitchPC on February 22, 2012, 10:56:04 AM
Thanks for the quick reply...

I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Only BB 4 SMF provides an accurate status of Project Honeypot.  httpBLmod uses the test that many other mods use from the Project Honeypot site that incorrectly states the connection is perfect when it is not.  Notice that it does not block anything when BB says the connection is down?

Quote from: GlitchPC on February 22, 2012, 10:56:04 AM

QuoteIn SMF you can whitelist member groups only.  Unlike httpBL, this mod will use the last known ip address of a whitelisted member and not block them if they are not logged in and their ip address has not changed.

What are you talking about?  That is not how the whitelist works.  Look at the link (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023) I provided.

Bottom line all new non-admin ip addresses not in the whitelist will be checked.  All non-admin users logged in beyond the cache limit, not in the whitelist, will be checked.

Quote from: GlitchPC on February 22, 2012, 10:56:04 AM
I have it installed, configured...and, apparently, enabled.  Yet, I get the error that Project HoneyPot is offline.  The httpBL mod I have states that the connection to HoneyPot is perfect.  I don't use Firefox...and don't want to end up blocking myself.

Any help?

Again you are not getting an error.  Project Honeypot is down often.

The mod does not block admins!  Furthermore, you can not block yourself if Project Honeypot is down.  When it is is down the BB tests takes over and they will not block you unless you are a spammer.  But if you like to act like a spammer the mod offers a whitelist.  Read this link (http://www.simplemachines.org/community/index.php?topic=375980.msg3149023;topicseen#msg3149023) for info on how to add your ip address range to the whitelist.

Quote from: GlitchPC on February 22, 2012, 10:56:04 AM
I don't use Firefox...and don't want to end up blocking myself.

What happens for Opera Turbo users?  Turbo creates different IPs quite a bit.  Will a member get denied access simply because they use Opera with Turbo enabled?  If so...how does one go about rectifying this issue...since they will have a different IP every time they log into the forum?

I do not see that as an issue with this mod.  The Project Honeypot portion checks the ip vs the spammer database and the Bad Behavior portion analyzes the delivery method as well as the software the spammer is using not the ip address.
:)

I, apparently, misunderstood what I read in your link.  Thanks for the clarification and a great mod.  It's doing its thing...and I couldn't be happier.

Is it possible to install the Bad Behaviour mod without the "suspicious" post button in the reply . Having tested the mod successfully, the comment from my other admins is that we'd prefer not to have that functionality.

Very nice mod! Seems to block the majority of spammers from my forum :)

Quote from: stevehow on February 25, 2012, 03:28:53 AM
Is it possible to install the Bad Behaviour mod without the "suspicious" post button in the reply . Having tested the mod successfully, the comment from my other admins is that we'd prefer not to have that functionality.

Unzip the package.

Edit "install_db.php" as follows:
delete:
if (function_exists('add_integration_function')) {
$badbehavior_integraton_hooks = array(
'integrate_bbc_codes' => 'badbehavior_suspicious_hide',
'integrate_bbc_buttons' => 'badbehavior_suspicious_button',
'integrate_pre_include' => '$boarddir/Sources/Subs_badbehavior_bbc.php',
);

foreach ($badbehavior_integraton_hooks as $badbehavior_hook => $badbehavior_integraton_function)
add_integration_function($badbehavior_hook, $badbehavior_integraton_function, TRUE);

Unset($badbehavior_integraton_hooks);
Unset($badbehavior_hook, $badbehavior_integraton_function);
}


Edit "uninstall_db.php" and delete:
if (function_exists('add_integration_function')) {
$badbehavior_integraton_hooks = array(
'integrate_bbc_codes' => 'badbehavior_suspicious_hide',
'integrate_bbc_buttons' => 'badbehavior_suspicious_button',
'integrate_pre_include' => '$boarddir/Sources/Subs_badbehavior_bbc.php',
);

foreach ($badbehavior_integraton_hooks as $badbehavior_hook => $badbehavior_integraton_function)
remove_integration_function($badbehavior_hook, $badbehavior_integraton_function);

Unset($badbehavior_integraton_hooks);
Unset($badbehavior_hook, $badbehavior_integraton_function);

//  Delete BBC code
if (!empty($modSettings['disabledBBC'])) {

$BB_uninstall_content = '';

if (strpos($modSettings['disabledBBC'], ',') !== false) {
$BB_uninstall_temp = array();
$BB_uninstall_temp = explode(',', strtolower($modSettings['disabledBBC']));

if (in_array('suspicious', $BB_uninstall_temp)) {
foreach ($BB_uninstall_temp as $key => $value)  {
$pos = strpos(strtolower($value), 'suspicious');
if ($pos !== false) {
} else {
$BB_uninstall_content .= $value . ',';
}
}
unset($value);
$BB_uninstall_content = substr($BB_uninstall_content, 0, -1);
}
} else {
if ($modSettings['disabledBBC'] !== 'suspicious')
$BB_content = $modSettings['disabledBBC'];
}
$smcFunc['db_insert']('replace',
$db_prefix . 'settings',
array('variable' => 'string', 'value' => 'string',
),
array(
array('disabledBBC', $BB_uninstall_content),
),
array('variable')
);
}
unset($BB_uninstall_temp);
}

Save.  Re-zip and install.