Bad Behavior for SMF mod

Started by butchs, April 12, 2010, 05:23:56 PM

Previous topic - Next topic

butchs

Do you have anything in the Whitelist settings of the mod?
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

BillLeeDee

Quote from: butchs on June 30, 2017, 02:24:39 PM
Do you have anything in the Whitelist settings of the mod?

There are a couple of dozen IP addresses and one user agent listed

butchs

I suspect you have a extra blank in the User Agent field.  You most likely hit a carriage return after entering the value.  Please remove the carriage return.

Some of that image looks like a SQL Injection attack.  I suggest you install CrawlProtect.
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

BillLeeDee

@butchs: I checked the user agent I had slugged in and there wasn't any return character afterwards. Since it was only one I simply removed it.

Thanks for the recommendation of CrawlProtect as I wasn't aware of it. I had written a multitude of traps into my htaccess file but this looks like it might be a better solution. Thanks.

butchs

Helps are back in first post.
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

siavoshkc

How can I install this mod on my v2.0.14? I can't find it in the list shown by my forum. Do I have to use manual method?

By the way is this the right place to ask this question?
Persian Translator

butchs

The mod should install with v2.0.14.  Not sure why you cannot see it.  Only install with the manual method if you have a custom theme.
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

butchs

This mod has been updated to the latest version of Bad Behavior, added Italian and bug fixes.  BB Changes:

  • A spurious PHP notice was removed. Fixes issue 121.
  • The current use of cookies to screen requests is being deprecated. Any cookies will be removed from users' browsers, if they exist. Fixes issue 131.
  • A new IP address range is in use by the Bing search engine; this range has been added to Bad Behavior.

See the first post for more info...
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

doughboy99

Hello

When i install this version I get a plus symbol at the top of every page in the forum. Bad behaviour doesn't run on the site although I can acces the setup pages. Reverting to an earlier version works  correctly.
Any ideas what might be causing this.

Thanks

butchs

#969
There is nothing wrong.  That is a Project Honeypot Google Safe Spam trap.  Check out the link in the "RANDOM CHARACTERS ABOVE FORUM HEADER" FAQ in the first post of this thread.

Setting up a spam trap helps contribute to project honey pot and keeps your site safe.  Attached are some I caught.
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

Arantor

You caught a lot of CloudFlare IPs in that list, interesting.

butchs

They have to click on the link to get on the list.  I use CloudFlare but years ago I noticed that some people use it to spam and some try to bypass CF.   I have not seen much of the latter in years after they revamped their system.
I have been truly inspired by the SUGGESTIONS as I sit on my throne and contemplate the wisdom imposed upon me.

Arantor

I was more noticing that the 172.68.7 range is owned by CloudFlare in Thailand for example, wasn't sure if this was skewing your findings or not.

BillLeeDee

I took a quick skim of the thread and might have missed it so please forgive me if this was already asked. Can the update be installed without removing the older version or do you need to remove the old version before installing the latest version?

Kindred

As with almost every mod ...  uninstall the old version first. ;)
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

BillLeeDee

That's what I thought but wanted to be certain. Thanks.

BillLeeDee

Has anyone noticed an text oddity with the 1.5.20 version. I uninstalled the older 1.5.19 version and installed the new version and noticed various portions of my site had the text size increase from what is normally. After installing it showed up as "upgrade" install instead of uninstall, so I had to restore the SMF directory from my backup.

I don't know if it has anything to do with the other assorted mods installed in the forum so when I get some spare time to take the forums offline I plan on another clean install with the Bad Behavior mod being the first one to be installed.

djkimmel

I had the same thing happen on several of my forums - the font size increased and messed up some of my layouts - primarily those with portals. I started thinking it might be a change in portal css but one of the forums the only change I made at the time was upgrading to Bad Behavior 1.5.20 and the fonts look supersized! I haven't had time yet to track down what it causing this.

djkimmel

Okay, I found the problem with mod Bad Behavior version 1.5.20 modified 12/31/2017. In the mod file /Sources/bad-behavior/BadBehavior-SMF.php that is called for all Bad Behavior actions, there is an errant carriage return and '+' sign at the very end of that file.

Delete the carriage return and plus sign so the file ends properly with '?>' and my fonts are no longer magnified.

djkimmel

Actually, looking at the 12/31/2017 modified date mod install package I do not see the '+' sign at the end? Only a line feed which should be removed anyway as I've always been told PHP doesn't like a blank line after the closing '?>' code. I didn't modify the install package but every install I did of Bad Behavior 1.5.20 has the carriage return and a plus sign at the end. However it is happening that is the problem with magnified fonts for my installs. Removing everything after the closing '?>' puts my fonts back to normal.

Advertisement: