False positive

[tristanbes]

Hello,

I'd like to report a false positive:
http://avocatlantic.fr/ is one of our website and is getting blocked (similar to #127)

[mitchellkrogza]

@tristanbes please tell me what version number you have in blacklist.conf?
Should be Version: V2.2017.09.19

[mitchellkrogza]

@tristanbes ok I see same behavior, Please try changing line 1261 of blacklist.conf from this

"~*anticrawler\.org" 1;

to this

"~*\banticrawler\.org\b" 1;

Then reload nginx and tell me if it re-occurs.

[mitchellkrogza]

@tristanbes I found the problem, will be addressed shortly in next update. Hang tight will have this fixed shortly. It appears Nginx Regex detection has changed so all bad referrers now require word boundaries \b as we do with User-Agents and Bots

[tristanbes]

I'm running on V2.2017.09.19.

I tried replacing the line 1261 (/etc/nginx/conf.d/blacklist.conf) with the patched line and reloaded nginx on both server. The issue is still present

[mitchellkrogza]

@tristanbes it's a bigger issue than that, I have actually solved it 100% in my testing environment, I am just busy fixing the generator scripts to address this and then it will be solved. I should have this done within the next hour max. So please stand by.

[mitchellkrogza]

Thanks for your patience and for alerting me to this issue. New fix will prevent this from ever happening again.

[tristanbes]

np, thanks for your fast reply to this issue

[mitchellkrogza]

@tristanbes fixed in latest commit > 6ace56d please pull latest blacklist.conf and reload nginx

[mitchellkrogza]

curl -I https://mitchellkrog.com -e http://www.zrus.org
curl: (52) Empty reply from server

curl -I https://mitchellkrog.com -e http://avocatlantic.fr/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 02 Oct 2017 14:05:59 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: wfvt_2652734163=59d2476b65a65; expires=Mon, 02-Oct-2017 14:34:27 GMT; Max-Age=1800; path=/; secure; HttpOnly
Set-Cookie: pvc_visits[0]=1506953067b3699; expires=Mon, 02-Oct-2017 14:04:27 GMT; Max-Age=0; path=/; secure; HttpOnly
ETag: "4b402446048d3e4224941d5614d08f7abd053bef"
Last-Modified: Tue, 25 Jul 2017 09:25:20 GMT
Expires: Mon, 02 Oct 2017 14:09:27 GMT
Cache-Control: private, must-revalidate, proxy-revalidate, max-age=300
Link: <https://mitchellkrog.com/wp-json/>; rel="https://api.w.org/"
Link: <https://wp.me/P7yhEJ-XF>; rel=shortlink
X-Cache: HIT
Strict-Transport-Security: max-age=15768000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer