Abuse-script : NukeSentinel(tm) 2.6.03

etoiledemoon · New Member Joined: Apr 29, 2010 Posts: 19

Hi

sometimes members of my website can't download on it because they
receive this :
you are attempting to access a restricted area
PLEASE: bear in mind that even if you have done nothing wrong, you may be getting this page due to someone's misuse of the site in your ip range

Members can access the download section since they are registered

And I receive this by email :

Created By: NukeSentinel(tm) 2.6.03
Date & Time: 2010-06-01 21:33:53 GMT GMT +0000
Blocked IP: 86.155.......
User ID: Sandy (16)
Reason: Abuse-Script
--------------------
Referer: on site
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6.5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
Script Name: /modules.php
Query String: name=Downloads&d_op=viewdownloaddetails&lid=40191&title=Dfx - Excitation 030 (AH.FM) -15-Mar-09
Get String: name=Downloads&d_op=viewdownloaddetails&lid=40191&title=Dfx - Excitation 030 (AH.FM) -15-Mar-09
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 86.155........
Remote Port: 62455
Request Method: GET

Any idea ?

nuken · Posted: Tue Jun 01, 2010 4:12 pm

It could be the use of dashes in the title. NukeSentinel may be interpreting it as potential hack attempt. Try removing the dashes from the title and see if it works. Also, the file name should not have spaces or dashes in it.

etoiledemoon · New Member Joined: Apr 29, 2010 Posts: 19

strange is that use since long time dashes or spaces in file names and this never happen , will try without just to see

nuken · Posted: Tue Jun 01, 2010 5:04 pm

That may not be the cause but it is worth a shot.

Palbin · Posted: Tue Jun 01, 2010 5:26 pm

I have narrowed it down to the parentheses. Having one or the other is fine, but when you have a closed pair that is when you run into the problem.

The real problem is that the download module is using the title instead of an ID to point to the download. I have no idea why someone would do that. Montego is working on a modified download module so hopefully that will solve the problem in the future.