[DBTech] DragonByte Security

[DBTech] DragonByte Security [Paid] 4.5.3

No permission to buy ($24.95)

DigNap15

Well-known member
I am very keen on gettng a way to block many countries that have no interest for.
I see your Add-on has that feature.
But I would be wary of it , becasue of all the other features it has, which I know nothing about.

If you ever made a stand alone country blocker that worked easily, I would buy it tomorrow
 

DragonByte Tech

Well-known member
DragonByte Tech updated [DBTech] DragonByte Security with a new update entry:

4.5.0 Beta 1

Update highlights

!!! THIS VERSION REQUIRES XENFORO 2.2.0 AND PHP 7.2.0 !!!

This version contains coding style updates and changes for XenForo 2.2.0 / PHP 7.2.0.

XenForo 2.2 features two new "Security lock" features that function slightly differently than the account locks already present in DragonByte Security. These two new features can now be used as Watcher actions where possible.

Furthermore, a couple bugs have been resolved.

This version is...

Read the rest of this update entry...
 

DragonByte Tech

Well-known member
DragonByte Tech updated [DBTech] DragonByte Security with a new update entry:

4.5.0 Gold

Update highlights

!!! THIS VERSION REQUIRES XENFORO 2.2.0 AND PHP 7.2.0 !!!

Coinciding with the release of XenForo 2.2.0, all XenForo 2.2 versions are now Gold 🎉 This is also the last version that will contain the XF 2.2 / PHP 7.2 warning in the release notes.


Complete Change Log

Fix: Fix typo in the "Reset password" watcher action

Read the rest of this update entry...
 

Maa

Member
Hi we have 2FA enabled and this, it attempts to scan face to allow member to login, accepts it, but then there is error.

Error: Call to undefined function Cose\Key\gmp_strval()
 

DragonByte Tech

Well-known member
Hi we have 2FA enabled and this, it attempts to scan face to allow member to login, accepts it, but then there is error.

Error: Call to undefined function Cose\Key\gmp_strval()
What makes you believe that's an error in this add-on?
 

DragonByte Tech

Well-known member
DragonByte Tech updated [DBTech] DragonByte Security with a new update entry:

4.5.2

Update highlights

This version fixes a few bugs related to the Watcher system reported by the community.


Complete Change Log

Fix: Hide log entries that do not have a valid Watcher record
Fix: Watcher log entries were not removed after a watcher had been deleted
Fix: If no security watchers were set up, the cache could be rebuilt repeatedly when this was not needed

Read the rest of this update entry...
 

Stuart Wright

Well-known member
Running 4.5.2 and getting a server error:
  • Assert\InvalidArgumentException: Invalid data
  • src/addons/DBTech/Security/vendor/beberlei/assert/lib/Assert/Assertion.php:2752
  • Generated by: Unknown account
  • Apr 27, 2021 at 12:07 PM

Stack trace​

#0 src/addons/DBTech/Security/vendor/beberlei/assert/lib/Assert/Assertion.php(319): Assert\Assertion::createException(0, 'Invalid data', 33, NULL, Array)
#1 src/addons/DBTech/Security/vendor/web-auth/webauthn-lib/src/PublicKeyCredentialLoader.php(78): Assert\Assertion::eq(0, 4, 'Invalid data')
#2 src/addons/DBTech/Security/vendor/web-auth/webauthn-lib/src/Server.php(221): Webauthn\PublicKeyCredentialLoader->load('')
#3 src/addons/DBTech/Security/Tfa/WebAuthn.php(265): Webauthn\Server->loadAndCheckAssertionResponse('', Object(Webauthn\PublicKeyCredentialRequestOptions), Object(Webauthn\PublicKeyCredentialUserEntity), Object(Nyholm\Psr7\ServerRequest))
#4 src/XF/Service/User/Tfa.php(129): DBTech\Security\Tfa\WebAuthn->verify('login', Object(SV\ConversationSharing\XF\Entity\User), Array, Object(XF\Http\Request))
#5 src/XF/ControllerPlugin/Login.php(121): XF\Service\User\Tfa->verify(Object(XF\Http\Request), 'dbtech_security...')
#6 src/XF/Pub/Controller/Login.php(133): XF\ControllerPlugin\Login->runTfaCheck('https://www.avf...')
#7 src/XF/Mvc/Dispatcher.php(350): XF\Pub\Controller\Login->actionTwoStep(Object(XF\Mvc\ParameterBag))
#8 src/XF/Mvc/Dispatcher.php(257): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'TwoStep', Object(XF\Mvc\RouteMatch), Object(SV\SignupAbuseBlocking\XF\Pub\Controller\Login), NULL)
#9 src/XF/Mvc/Dispatcher.php(113): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(SV\SignupAbuseBlocking\XF\Pub\Controller\Login), NULL)
#10 src/XF/Mvc/Dispatcher.php(55): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#11 src/XF/App.php(2326): XF\Mvc\Dispatcher->run()
#12 src/XF.php(488): XF\App->run()
#13 index.php(20): XF::runApp('XF\\Pub\\App')
#14 {main}

Request state​

array(4) {
["url"] => string(15) "/login/two-step"
["referrer"] => string(105) "https://www.avforums.com/login/two-step?_xfRedirect=https://www.avforums.com/forums/&remember=1"
["_GET"] => array(1) {
["/login/two-step"] => string(0) ""
}
["_POST"] => array(11) {
["publicKeyCredential"] => string(0) ""
["trust"] => string(1) "1"
["trust_permanent"] => string(1) "1"
["confirm"] => string(1) "1"
["provider"] => string(21) "dbtech_security_authn"
["remember"] => string(1) "1"
["_xfRedirect"] => string(32) "https://www.avforums.com/forums/"
["_xfToken"] => string(8) "********"
["_xfRequestUri"] => string(81) "/login/two-step?_xfRedirect=https%3A%2F%2Fwww.avforums.com%2Fforums%2F&remember=1"
["_xfWithData"] => string(1) "1"
["_xfResponseType"] => string(4) "json"
}
}

Invalid data?
What does that mean, please?
 

Fred.

Well-known member
@DragonByte Tech

I Enabled strict mode because I still had spam passing all my filters. This seems to have stopped the spam but also blocked the AMPXF bot.
So I put the listed IP ranges on the whitelist and hoped that would fix it but it doesn't. It's still blocked for bad behavior.
Maybe it's not taking the IPv6 range properly? I don't see the IPv4 in the log so that might be ok. But it prefers or needs IPv6 i think.


Code:
Bad Behavior log #440519

IP address
    2a01:4f9:4b:1421::2

Date
    2021-05-02 13:01:50

Request method
    GET

Request URI
    /threads/amprobot.14430?amp=1

Response
    [400] "Header 'TE' present but TE not specified in 'Connection' header

Server protocol
    HTTP/1.1

User agent
    Mozilla/5.0 (compatible; AMPXFBot/1.0; +http://ampxf.com/bot)

HTTP Headers

string(307) "'GET' '/threads/amprobot.14430?amp=1' 'HTTP/1.1'
Connection: keep-alive
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; AMPXFBot/1.0; +http://ampxf.com/bot)
Sentry-Trace: 846655bbb18147538d42c5acefc521ab-86f5010d82c3bc75-1
Host: example.com
Content-Length:
Content-Type:
"

Any suggestions?
 

DragonByte Tech

Well-known member
Enabled strict mode because I still had spam passing all my filters. This seems to have stopped the spam but also blocked the AMPXF bot.
So I put the listed IP ranges on the whitelist and hoped that would fix it but it doesn't. It's still blocked for bad behavior.
Maybe it's not taking the IPv6 range properly? I don't see the IPv4 in the log so that might be ok. But it prefers or needs IPv6 i think.
The whitelist is not related to Bad Behavior at all, sorry. It only affects the Security Watchers feature.
 

Fred.

Well-known member
The whitelist is not related to Bad Behavior at all, sorry. It only affects the Security Watchers feature.
Ok. Thanks for that.
Is there a way to prevent Bad Behavior from blocking this valid good bot while strict mode is on?
When I disable strict mode it works. But then my forum gets spammed.
 
Top