Top Module Download Link: Blocked for abuse?

Posted: Sun Oct 08, 2006 2:29 pm

What's up with this? I have several links to this file in my downloads section, and when I click on it I cannot trigger Sentinel. Not all my users have run into this. I'm using Sentinel 2.5.02. Thank you!!!

Code:




Date &amp; Time: 2006-10-08 15:28:18 EDT GMT -0400


- Hide quoted text -


Blocked IP: x.x.x.x


User ID: SomeUser (12)


Reason: Abuse-Script


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)


Query String: www.mysite.com/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=39&ttitle=The_Czar_Of_Surf_Guitar__(Tribute_To_Ivan)_-_THE_ILLUMINOIDS


Get String: www.mysite.com/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=39&ttitle=The_Czar_Of_Surf_Guitar__(Tribute_To_Ivan)_-_THE_ILLUMINOIDS


Post String: www.mysite.com/modules.php


Forwarded For: none


Client IP: none


Remote Address: x.x.x.x


Remote Port: 1742


Request Method: GET

Sells PC To Pay For Divorce Joined: Posts: 5661

huh...
reading this makes me believe nothing is wrong ?

Quote:

and when I click on it I cannot trigger Sentinel

You cannot trigger.....

So all is ok...
or im missing the point here.... Confused

Posted: Sun Oct 08, 2006 4:36 pm

My user clicked on a downloads link and was greeted with the black scary page of death, and I was emailed. Why?

It doesn't happen all the time, as I see that the download has about 20 hits so far.

If this were a C/C++ program I'd say it was an uninitialized variable or something.

Why did Sentinel do that?

Posted: Sun Oct 08, 2006 4:38 pm

probably because of characters used in the url...
that seems most likely...

Posted: Sun Oct 08, 2006 4:53 pm

I and 20 other users have clicked on that same link without any problems.

Posted: Sun Oct 08, 2006 4:57 pm

well its hard to find out what the "others" have in common...that do get the black screen...
but realy......
is it needed to use such download urls ?

instead of :
The_Czar_Of_Surf_Guitar__(Tribute_To_Ivan)_-_THE_ILLUMINOIDS

TheCzarOfSurfGuitar-Tribute-To-Ivan-THE_ILLUMINOIDS

or :

hre89fhgriufhrigjhrjkgrug5utgf04uirfgoirujgo5.zip

Posted: Sun Oct 08, 2006 5:02 pm

The link was generated by the Top module:

Code:




modules.php?name=Downloads&d_op=viewdownloaddetails&lid=39&ttitle=The_Czar_Of_Surf_Guitar__(Tribute_To_Ivan)_-_THE_ILLUMINOIDS

However, I don't understand why passing $ttitle is necessary. It will work without it. So I will recode the Top module so that it generates links like this instead:

Code:




modules.php?name=Downloads&d_op=viewdownloaddetails&lid=39

Still, I think Sentinel has a bug.

Posted: Sun Oct 08, 2006 5:07 pm

no not realy a bug.
problem is ,that you cannot prevent this from happening..
at the right time,place,script,name,link, whatever it can trigger sentinel on a weeird string..

Posted: Sun Oct 08, 2006 5:12 pm

How could it not be a bug? The same link, when clicked on by 20 some people is fine, but all of a sudden out of the blue a valid registered user is blocked.

Posted: Sun Oct 08, 2006 5:16 pm

it can have a lot of reasons..
even the browser they use...
have you seen more posts...exactly like yours?

Posted: Sun Oct 08, 2006 5:51 pm

Okay, I take some of what I wrote back. I have reviewed some logs and asked some users some questions.

It seems the link generated by the Top module with the ttitle string in the URL will cause Sentinel to flag abuse 100% of the time with that particular string.

The other 20 users had downloaded the file through the Downloads module, where no such crazy ttitle= string was present in the generated URLs there.

My re-coding of the Top module to generate links like the Download module seems to have fixed the problem.

Still I am curious why the ttitle= string was flagged as abuse? It contained no SQL keywords, just some parenthesis, underscores, and dashes? Maybe the abuse filter can be tightened up a bit?

Posted: Sun Oct 08, 2006 6:00 pm

well trust me on this,the people that write sentinel are smarter then both of us together... Laughing

all has a reason...,and sometimes this happens..

Posted: Mon Oct 09, 2006 6:48 am

I have edited my first post, and added "Top Module Download Link" to it now that I know whats going on. Maybe it will help someone who runs into that in the future.

I don't understand why the Top module was generating links like that, adding a title. Why would the downloads module use a title it got passed to it instead of just looking it up in the database? Well, there is a lot of things I don't understand about Nuke. Wink

Posted: Mon Oct 09, 2006 6:50 am

And the other thing that was tripping me up. When I was trying to test the link that triggered the abuse, I was logged in as admin. Apparently, Sentinel cuts you some slack if you are an admin. Finally, I used one of my regular test users and got the same behavior. I hope that is useful to someone too.

registered · Posted: Mon Oct 09, 2006 8:47 pm

I believe the issue is just the title name using parenthesis. I believe also that this exact issue has been addressed before in the forums. The use of parenthesis I mean. It is a necessary evil... Remove the parenthesis from your download title and I believe the issue will go away.

Posted: Tue Mar 20, 2007 3:40 pm

I'm seeing this problem again with RN2.10. The downloads module is generating links with ttitle set equal to the title of the download. I still don't understand why it needs to do this, since the lid variable already in the link uniquely identifies the download. It is not like the downloads module searches on ttitle...it uses lid. Confused

I am going to remove the ttitle from the link to avoid triggering sentinel on downloads that have parenthesis in the titles.

It is interesting to note that the 7.9 downloads module stopped adding ttitle to links.

Does anyone know what the purpose of ttitle is?

Posted: Tue Mar 20, 2007 4:32 pm

Wow, the ttitle stuff is all over the downloads module code, so I punted and just removed the parens from the 7 downloads that had parenthesis. Smile

I'll study the code a bit later. It just seems to me that one would look up the title in the database, not pass it around in links and get it through $_GET variables. Confused

Posted: Wed Mar 21, 2007 5:48 am

There is a school of thought in the SEO "world" that having more descriptive links being crawled is better for SEO results. That is the only reason why I would ever consider having titles in the links. I have a strong feeling that is why this was done this way... of course, FB couldn't not be consistent across the modules.

Posted: Wed Mar 21, 2007 6:46 am

I see. The Web Links module does the same thing. Sad

My clueless users are clicking on things that previously worked under 7.9 and now are getting the big black scary abuse screens. LOL.

Posted: Wed Mar 21, 2007 6:58 am

Quote:

I see. The Web Links module does the same thing

Correct! Web Links was a copy of Downloads and then with more bugs introduced.. Wink

registered · Posted: Wed Mar 21, 2007 2:42 pm

Both Web_Links and Downloads used ttitle.. who knows why though. It was removed from 7.9 and higher I believe

Posted: Wed Mar 21, 2007 3:05 pm

Yep, I can confirm ttitle is not in 7.9's Web Links or Downloads module...(but it was left in the 7.9 Top Module; gotta love FB's quality control).

Posted: Mon Apr 16, 2007 7:01 am

I went ahead and removed all the ttitle stuff from my Downloads and Web_Links. I had content with parenthesis, etc that worked previously in 7.9, but now it started triggering Sentinel. Got tired of explaining to users they weren't doing anything wrong. LOL.

Posted: Mon Apr 16, 2007 5:28 pm

Bummer. Ok, guess we ought to consider it for a future RN release too. The work never ends...

Crying or Very sad

Posted: Tue Apr 17, 2007 6:58 am

Yes and I just realized after I hacked all that ttitle stuff out that now I am going to have to merge any new RN fix pack changes in when I upgrade. Unless of course I put my changes into the next RN. But not everyone may want my changes if there really is an SEO reason.