Chaz's Issue

These are old archives. They are kept for historic purposes only.
Post Reply
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Chaz's Issue

Post by Stealth » Sat Jan 01, 2005 8:20 pm

Someone came to the support channel early this morning (well, not so early - but either way, I wasn't up yet) with a small but simple spamfilter issue. His paste contained the following text:
chaz's paste wrote:spamfilter {
regex "http://*:*/*\.exe";
target { private; channel; };
action gline;
reason "You are infected";
ban-time 6h;
};


Trying to block lines such as;

[19:48:38] ‹ bwghm › http://83.177.222.179:63891/q.exe
[23:08:35] ‹ kx-yd › http://192.168.0.100:18934/qhithjq.exe
[10:39:03] ‹ gudnk › http://81.77.200.207:37994/vjkadnrmb-.exe
I instantly noticed his regex was really bad (I think I have helped him with regex before)... But anyway, the block should be:

Code: Select all

spamfilter {
        regex "http://(\d+\.){3}\d+:\d+/.+\.exe";
        target { private; channel; };
        action gline;
        reason "You are infected";
        ban-time 6h;
};
Also, maybe he should but a better reason on it... Perhaps a link to a page that explains why the user was banned for 6 hours, and how to remove the virus. I am sure there will be many false posatives!

(If someone can give it a better name, please do so) :P

Guest

Post by Guest » Tue Feb 01, 2005 2:19 pm

Wow im impressed. That was me!

The reason was just there for now until I had worked on the page letting users know why they had been banned.

Many thanks for the fixed regex, and I dont think ive spoke to you before as this was my first regex encounter!

Thanks again.

Guest

Post by Guest » Tue Feb 01, 2005 2:21 pm

Tell a lie, I just looked in my unreal-support logs and found your name all over it from helping me in the past.

Thanks again Stealth.

Post Reply