Clicking on Legitimate Link causes user to be banned

Dauthus · Worker Joined: Oct 07, 2003 Posts: 211

I have a kind of game set up in my forums called hidden image. There is a button which flashes the words "click me" that randomly appears in different posts. Once it is clicked, the button randomly goes to another post and the user is given 500 points for finding it.

My only problem is when a user now clicks on the button they get banned. The link for the post with the image is here: DONT CLICK IT OR YOU WILL BE BANNED!!

Only registered users can see links on this board!
Get registered or login to the forums!

The button is at the bottom of the post, next to the profile button.

When the user clicks on the button, they are sent to this location:

Only registered users can see links on this board!
Get registered or login to the forums!

Which is a legitimate link. The only problem is they are getting banned. Any way to work around this?

Specifics:

PHP-Nuke 7.4 patched 2.9 (the one prior to 3.0)
Sentinel 2.2.1

BobMarion · Posted: Sat Jun 11, 2005 12:30 am

NukeSentinel(tm) checks for the following:

Code:

// Check for Forum attack
// Copyright 2004(c) GanjaUK & ChatServ
if (!stristr($nsnst_const['query_string'],'&file=nickpage') AND stristr($nsnst_const['query_string'],'& user =') AND ($name=="Private_Messages" || $name=="Forums" || $name=="Members_List")) {
block_ip($blocker_row);
}

You see there is an attack that uses the word user followed by the = sign in forums which we have protected against.

I suggest you change the link code from user= to something like uid= since it is a number anyway. That would most likely cause you to go thru the mod and find each user= and replace them with uid= as well though.

Dauthus · Worker Joined: Oct 07, 2003 Posts: 211

Couldn't I add something so the query makes an exception if the stirng is called with the "randimage" file?

I hate to try and find and replace all the user to uid in this mod and then try and get the code to work again, if I can just make an exception for the specific file I use.

Raven · Posted: Sat Jun 11, 2005 6:38 pm

Try changing (not tested)

Code:

stristr($nsnst_const['query_string'],'& user =')

to

Code:

(stristr($nsnst_const['query_string'],'& user =') AND !stristr($nsnst_const['query_string'],'randimage'))

Dauthus · Worker Joined: Oct 07, 2003 Posts: 211

Thanks! I'll let you know how it goes.

Edit: It works perfectly. Thanks for the help.