Clicking on Legitimate Link causes user to be banned

registered · Worker Joined: Oct 07, 2003 Posts: 211

I have a kind of game set up in my forums called hidden image. There is a button which flashes the words "click me" that randomly appears in different posts. Once it is clicked, the button randomly goes to another post and the user is given 500 points for finding it.

My only problem is when a user now clicks on the button they get banned. The link for the post with the image is here: DONT CLICK IT OR YOU WILL BE BANNED!!

http://www.bootleghollow.com/modules.php?name=Forums&file=viewtopic&t=369

The button is at the bottom of the post, next to the profile button.

When the user clicks on the button, they are sent to this location:

http://www.bootleghollow.com/modules.php?name=Forums&file=randimage&user=2&post_id=697

Which is a legitimate link. The only problem is they are getting banned. Any way to work around this?

Specifics:

PHP-Nuke 7.4 patched 2.9 (the one prior to 3.0)
Sentinel 2.2.1

registered · Posted: Sat Jun 11, 2005 12:30 am

NukeSentinel(tm) checks for the following:

Code:

  // Check for Forum attack


  // Copyright 2004(c) GanjaUK & ChatServ


  if (!stristr($nsnst_const['query_string'],'&file=nickpage') AND stristr($nsnst_const['query_string'],'& user =') AND ($name=="Private_Messages" || $name=="Forums" || $name=="Members_List")) {


    block_ip($blocker_row);


  }

You see there is an attack that uses the word user followed by the = sign in forums which we have protected against.

I suggest you change the link code from user= to something like uid= since it is a number anyway. That would most likely cause you to go thru the mod and find each user= and replace them with uid= as well though.

Posted: Sat Jun 11, 2005 4:55 pm

Couldn't I add something so the query makes an exception if the stirng is called with the "randimage" file?

I hate to try and find and replace all the user to uid in this mod and then try and get the code to work again, if I can just make an exception for the specific file I use.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Try changing (not tested)

Code:

stristr($nsnst_const['query_string'],'& user =')

to

Code:

(stristr($nsnst_const['query_string'],'& user =') AND !stristr($nsnst_const['query_string'],'randimage'))

Posted: Sat Jun 11, 2005 8:06 pm

Thanks! I'll let you know how it goes.

Edit: It works perfectly. Thanks for the help.