YaBB Development & Mods

(UTC)

Change Template: Choose Language:

Topic Summary - Displaying 10 post(s). Click here to show all

Posted by: Dandello
Posted on: Nov 22^nd, 2014 at 5:50am

Switching the 'open window' command to javascript should solve most of the problem with bots and blocking guest access via the mod will help. (And I'll get onto adding the permissions section for the other print function soon.)

Posted by: Red Barchetta
Posted on: Nov 22^nd, 2014 at 1:15am

Just a quick note, but remember that IIS does not use .htaccess, so it will have no effect when YABB is running on a Windows IIS server.

Posted by: Dandello
Posted on: Nov 13^th, 2014 at 11:31pm

Some experimental fixes:

In Languages/English/Main.lng add just above the 1; at the bottom

Code (Perl)

$maintxt{'printpage'} = 'Print this page';

In Sources/Display.pm find:

Code (Perl)

    $template_print =
 qq~$menusep<a href="$scripturl?action=print;num=$viewnum" target="_blank">$img{'print'}</a>~;

replace with

Code (Perl)

    $template_print =
 qq~$menusep<a href="javascript:void(window.open('$scripturl?action=print;num=$viewnum','printw
indow'))">$img{'print'}</a>~;

Find:

Code (Perl)

            $template_print_post =
 qq~$menusep<a href="$scripturl?action=print;num=$viewnum;post=$postnum" target="_blank">$img{'printp'}</a>~;

Replace with:

Code (Perl)

                $template_print_post =
 qq~$menusep<a stnum','printwindow'))">$img{'printp'}</a>~;

In Sources/InstantMessage.pm find:

Code (Perl)

    $showIM_link .= qq~
             $menusep<a href="$scripturl?action=imprint;caller=$INFO{'caller'};id=$messageid" target="_blank">$img{'print_im'}</a>
         ~;

Replace with:

Code (Perl)

    $showIM_link .= qq~
             $menusep<a href="javascript:void(window.open('$scripturl?action=imprint;caller=$INFO{'calle
r'};id=$messageid','printwindow'))">$img{'print_im'}</a>
         ~;

In Sources/Printpage.pm find

Code (Perl)

 function printPage() {
     if (window.print) {
         agree = confirm('$maintxt{773}');
         if (agree) window.print();
     }
 }

Remove it. (twice)
Find

Code (HTML)

<body onload="printPage()">

Replace with

Code (HTML)

<body>

(twice)

Find:

Code (Perl)

</table>
 <br />~;

     $output .= qq~

Replace with:

Code (Perl)

</table>
 <form><p style="text-align:center"><input type="button" value=" $maintxt{'printpage'} " onclick="window.print();" /></p></form>
 ~;

     $output .= qq~

Find:

Code (Perl)

<br />~;
     }

     $output .= qq~

Replace with:

Code (Perl)

<br />
 ~;
     }

     $output .= qq~
 <form><p style="text-align:center"><input type="button" value=" $maintxt{'printpage'} " onclick="window.print();" /></p></form>

These changes use javascript to create the 'printable window' and also uses a button to call the actual print function. (One of the things I'm pretty sure was happening was the server was waiting for a browser response on a function that was automatically loaded but a bot couldn't respond to - and so long as it was waiting, CPU resources were being eaten up.)

I would like to have the printable window autoclose after printing but the 'window.close' function doesn't work properly in Chrome/Safari.

Posted by: Dandello
Posted on: Nov 13^th, 2014 at 8:13pm

Okay - the actual Print function is javascript. BUT, calling the printable page generates a new page which has to be closed by hand even after the print job has finished.

So I see a couple of problems - one is that the page can be generated by bots and the other is that it doesn't close when the print job is done.

Posted by: Dandello
Posted on: Nov 13^th, 2014 at 6:53pm

Okay - so we also need a method of detecting if there's a printer or have a timeout on the process (or javascript intercept of some nature ).

I should have the Print Post permissions ready in a few hours as well.

Posted by: pyragony54
Posted on: Nov 13^th, 2014 at 6:33pm

Yes, but that will not stop the problem. The CPU then sends continuously the printer information and that makes them until a message comes from the printer. Eventually increases the load on the CPU to 100%. It then helps only a restart of Apache and I'm sometimes up to 10 times a day.

Posted by: Dandello
Posted on: Nov 13^th, 2014 at 4:07pm

I'm in the process of fine-tuning the code for disabling Print Post. Print Topic has been part of YaBB for a long time but Print Post is a newer function and I can see bots hammering at all the links in a topic. And it's not just that they're opening hundreds of pages - they're also hammering the ErrorLog when those pages throw errors.

Adding the additional ErrorLog Security will help block the fast repeat offenders using .htaccess to stop them before they hit the cgi-bin. (It's a "three strikes you're out" mechanism - 3 errors in an inhumanly fast time and the IP gets blocked.)

Posted by: pyragony54
Posted on: Nov 13^th, 2014 at 2:54pm

thank Dandello. I'm going tonight with the night express from northern Germany to southern Germany. Look at me then tomorrow morning. Could help. It is important that you can turn off the print function for guests.

I think I will not be there the only one who could have the problem.

My house is almost finished and in two to three weeks, I have more time for YaBB.

Posted by: Dandello
Posted on: Nov 13^th, 2014 at 5:14am

I suggest you add ErrorLog Security to block the repeat offenders.

I'll look at creating some Admin print options - like members only and/or disabling Print Post.

Posted by: pyragony54
Posted on: Nov 13^th, 2014 at 3:48am

I think the pictures say it all already. Our server operator has already threatened with dismissal. Our CPU usage constantly increased to 100% and we had no explanation why. In the early versions YaBB this was not the case. After a few days of observation, I had the declaration by constantly monitoring and comparing the error log. It is the print function. Somehow spambots press the Print function and a few hundred times in a row and within seconds. This drives the CPU utilization on the top. They also automatically falls not decrease even if the spammer disappears. I have only then restart Apache.

The print function must be revised fastest and brooks no delay. Well, it would also be able to disable this feature in the Admin Center.

Question:

Options:	Text	Color	Split Pie
Option 1:
Option 2:
Option 3:
Option 4:
Option 5:
Option 6:
Option 7:
Option 8:
Poll Comment:	Max 500 characters. Remaining characters:

Automatic End in:	days and minutes. Leave it blank if you don't want to set it now.
Enable Guest Voting:	Check this if you want guests to be able to vote in this poll.
Hide results:	Check this if you do not want the results of this poll shown until voting has been closed.
Multiple Choice	Check this if you want to allow users to vote for more than one option.
Time limit for deleting vote:	Time in minutes users are allowed to delete their vote (0 to disable delete).
Use legends for Pie Chart	Check this to use legends instead of labels next to each pie slice.
Pie Chart Radius:	Must be a value between 100 and 200 (default 100)

Name:
E-mail:
Your Verification Code is:	Please type the characters exactly as they appear in the image, without the first 2 and last 2 characters. The characters must be typed in the same order, and they are case-sensitive.
Verification Code:
Preview