Blocked/Abuse when sending PM's

New Member Joined: Aug 25, 2005 Posts: 15

I recently upgraded my site to 2.5.03 and now myself and many others are getting abuse messages when trying to send a PM. I played around with it and it seems that a few lines of text will go through as a PM but anymore and it sees it as abuse.

The message says you have been blocked from entering this site and if you click on home it seems you are logged out but a refresh fixes that. So we are not even being blocked.

Any help appreciated.

Posted: Mon Nov 27, 2006 6:03 pm

what version of nuke?

what type of your_acount module are you using?

Posted: Mon Nov 27, 2006 9:38 pm

Running Nuke 7.6 fully patched. Just using the regular "Your Account".

I am now being informed that people are getting abuse errors when positng in the forums also.

Posted: Mon Nov 27, 2006 11:34 pm

Specifically what error?

Posted: Tue Nov 28, 2006 11:16 am

Forgive me it is not an error but an "Abuse Message". You have been blocked from this site. Reason Abuse - Script.

Posted: Tue Dec 05, 2006 3:08 pm

Am I the only one having this problem? Do you need more details? This is a big problem for my site and many people are getting abuse - script messages.

Thanks

Posted: Tue Dec 05, 2006 4:31 pm

Yes would need more details. What are you trying to post in the PM?

Posted: Wed Dec 06, 2006 5:10 am

It seems if you post a small PM or forum post it is ok but several paragraphs and you may get the abuse message.

I don't know if this has anything to do with the problem but maybe it does. I was not sure what version of Sentinel we had installed so I just uploaded all the files from the latest version. I then made the changes to the files that needed it per instructions. I ran the install file and instead of upgrading I chose the option to erase all sentinel tables. I then ran the install file again and installed the tables for the latest version that I was installing. Could this be the problem? Should I just uninstall fully then reinstall it again? I thought that by uploading the new files that would overwrite the old ones but maybe I was wrong.

If you need anymore info or a screenshot of the abuse messages please let me know and I will be glad to provide them.

Thanks for any help

Posted: Wed Dec 06, 2006 7:02 am

What is important to know is are they posting HTML / Javascript code when this happens? If so, what are they trying to post? Don't post the exact code because you could be banned here as well, but maybe make a text file out of one and post a link to it here so we can take a look.

Posted: Wed Dec 06, 2006 6:53 pm

Some people tell me they get it when they reply to a post and they quote the person they are replying to. Others tell me they get it by just typing a regular post or PM. All of the abuse emails are sent to me and I don't ever see anything wrong with what the person had typed. I have asked and nobody so far is using any HTML / Javascript.

I personally wrote a PM to somebody with no cut and paste / code or anything - just plain text that I wrote. I got the abuse message and I tried sending it multiple times but still got that message. So I started fresh and just sent a few lines of text and it went through with no problem.

Posted: Wed Dec 06, 2006 7:39 pm

Since you have not provided us an example, you are left with looking at the code in includes/nukesentinel.php around this here:

if(!is_admin($_COOKIE['admin'])) {
// Check for SCRIPTING attack
// Copyright 2004(c) ChatServ

And see if you can figure out which one of the checks in there is getting tripped and why. Something just doesn't sound right about your installation.

Regular Joined: Aug 05, 2006 Posts: 55 Location: Thailand

I've had this problem reported to me also from one of the sites that I maintain.

When sending a PM, the user was banned. A copy of the actual private message was attached to the emailed abuse report.

I've posted a copy of the abuse report as a text file here...
[ Only registered users can see links on this board! Get registered or login! ]

I'm wondering if it might be something Mac Related, because this user was using Mac / Safari, and another Mac / Safari user was mysteriously banned a few days before this happened.

The site is using a fully patched version of RN 7.6.

If anyone can shed some insight, I'd be grateful and sure that highlanddesigns would be too!