Chaz's Issue

[Stealth]

Someone came to the support channel early this morning (well, not so early - but either way, I wasn't up yet) with a small but simple spamfilter issue. His paste contained the following text:

spamfilter {
regex "http://*:*/*\.exe";
target { private; channel; };
action gline;
reason "You are infected";
ban-time 6h;
};


Trying to block lines such as;

[19:48:38] ‹ bwghm › http://83.177.222.179:63891/q.exe
[23:08:35] ‹ kx-yd › http://192.168.0.100:18934/qhithjq.exe
[10:39:03] ‹ gudnk › http://81.77.200.207:37994/vjkadnrmb-.exe

I instantly noticed his regex was really bad (I think I have helped him with regex before)... But anyway, the block should be:

Code: Select all

spamfilter {
        regex "http://(\d+\.){3}\d+:\d+/.+\.exe";
        target { private; channel; };
        action gline;
        reason "You are infected";
        ban-time 6h;
};

Also, maybe he should but a better reason on it... Perhaps a link to a page that explains why the user was banned for 6 hours, and how to remove the virus. I am sure there will be many false posatives!

(If someone can give it a better name, please do so)

[Guest]

Wow im impressed. That was me!

The reason was just there for now until I had worked on the page letting users know why they had been banned.

Many thanks for the fixed regex, and I dont think ive spoke to you before as this was my first regex encounter!

Thanks again.

[Guest]

Tell a lie, I just looked in my unreal-support logs and found your name all over it from helping me in the past.

Thanks again Stealth.