False Positive?

New Member Joined: Jul 30, 2003 Posts: 8

Quote:

User ID: Anonymous (1)
Reason: Abuse-Script
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; .NET CLR 1.1.4322)
Query String:
example.com/modules.php?name=coppermine&file=thumbnails&meta=search&type=full&search=%22Waiparous+Creek%22

A member was banned based on the above Coppermine search. I'm using 2.1.1. Any ideas why this would have triggered?

Subject Matter Expert Joined: Feb 23, 2004 Posts: 358

most likely the %22 was getting snagged, as it looks like a santy worm attempt. there are fixes posted around with the lines to comment out or modify to allow such strings.

PHrEEk

Posted: Mon Jan 24, 2005 10:40 pm

PHrEEkie wrote:

most likely the %22 was getting snagged, as it looks like a santy worm attempt. there are fixes posted around with the lines to comment out or modify to allow such strings.

PHrEEk

If you mean something like Only registered users can see links on this board! Get registered or login!, 2.1.1 doesn't do this. I got that from searching for santy worm. The search engine doesn't work well with %22. Any other ideas or something I could search for? Thanks for the help!