Issue with the Better Analytics plugin

  • Resolved isaacl

    (@isaacl)


    10 years, 11 months ago

    I’m seeing a bunch of these entries in the BPS security log (I removed the IP address):

    [403 GET / HEAD Request: June 29, 2015 – 12:18 pm]
    Event Code: PSBR-HPR
    Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
    REMOTE_ADDR: x.x.x.x
    Host Name: static-x-x-x-x.nycmny.fios.verizon.net
    SERVER_PROTOCOL: HTTP/1.1
    HTTP_CLIENT_IP:
    HTTP_FORWARDED:
    HTTP_X_FORWARDED_FOR: x.x.x.x
    HTTP_X_CLUSTER_CLIENT_IP:
    REQUEST_METHOD: GET
    HTTP_REFERER: https://mydomain.com/
    REQUEST_URI: /wp-content/plugins/better-analytics/js/loader.php?ver=1.0.5.js
    QUERY_STRING:
    HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36

    I tried following another thread (https://wordpress.org/support/topic/conflict-with-social-share-plugin), and added this in under the CUSTOM CODE PLUGIN/THEME SKIP/BYPASS RULES area:

    # S=13: Better Analytics skip/bypass rule
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/better-analytics/ [NC]
RewriteRule . - [S=13]

    I also added this under the CUSTOM CODE TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE area (with mydomain set to my site’s domain):

    # TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE
# Only Allow Internal File Requests From Your Website
# To Allow Additional Websites Access to a File Use [OR] as shown below.
# RewriteCond %{HTTP_REFERER} ^.*YourWebsite.com.* [OR]
# RewriteCond %{HTTP_REFERER} ^.*AnotherWebsite.com.*
RewriteCond %{QUERY_STRING} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
RewriteRule .* index.php [F,L]
RewriteCond %{REQUEST_URI} (loader\.php|timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
RewriteCond %{HTTP_REFERER} ^.*mydomain.com.*
RewriteRule . - [S=1]

    However, I am still seeing the errors in the security log.

    Any ideas how I can get this working?

    Thanks a lot!

    Edit: I just realized that I had to change the get-noapi-counts line in the second block to loader, and remove the second entry (updated above), but that still isn’t working, and I’m still seeing the errors in the log.

    https://wordpress.org/plugins/bulletproof-security/

Viewing 15 replies - 16 through 30 (of 38 total)
1 2 3
  • Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    @isaacl -also deactivate/delete wp-admin BulletProof Mode just to completely rule out that anything from the wp-admin folder could be involved. Logically the wp-admin folder does not factor into this equation, but always good to rule out all possibilities.

    digitalpoint

    (@digitalpoint)

    10 years, 11 months ago

    isaacl – probably because no other plugin needs to load any PHP files direct… As far as I can tell, your server just has all PHP files blocked for direct access within the wp-content folder. For example if you just go to wp-content/index.php normally it would just be a blank page, but yours gives a 403… so it doesn’t even need to go as deep as the plugins folder. Just seems to be any PHP file within wp-content (and sub-directories).

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    Rebuilding my Apache config (using EasyApache) to rule that out.
    I also was using nginxcp, which shouldn’t affect this, but I removed that first as well.
    @digitalpoint – if this is the only plugin loading PHP files directly, is there any way to work around that?
    I did lock my server and site down as much as possible (in big part thanks to the BPS Security plugin), but the once I disabled that, things should have loaded…

    Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    I think EasyApache will not do anything regarding changing your server config in the httpd.conf or vhosts conf files. You want to check your server config files to make sure you are not restricting something that should not be restricted.

    Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    hmm I wonder if you need to add a php handler or the php handler you are using is incorrect/not valid? Are you using php handlers in your httpd.conf or vhosts conf files?

    digitalpoint

    (@digitalpoint)

    10 years, 11 months ago

    isaacl – It would be nice, but the only other way I know to get JavaScript on the page would be to include it inline on the page, and it’s a lot of JavaScript to be loading on every page view (including it as a separate file allows it to be cached on the user’s browsers).

    It would be nice if WordPress had routes you could utilize through it’s normal index.php, but it doesn’t do that unfortunately.

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    EasyApache had an option that says “Reset Apache Config to default – any customizations will be lost (this session only)”, which I used, since I’m pretty sure that I never made any changes to the server config.

    Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    So do you see the issue that digitalpoint posted regarding the default Apache 2.4.x httpd.conf setting: Require all denied should be changed to Require all granted, save your edit and reboot your server.

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    My httpd.conf file only has one Require all denied:

    <Files “.ht*”>
    Require all denied
    </Files>

    So don’t see anything that would help there.

    Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    So what is your <Directory… directive doing? Are you using vhosts or not? Post that code.

    Plugin Author AITpro

    (@aitpro)

    10 years, 11 months ago

    Example:

    <Directory "C:/xampp/cgi-bin">
    AllowOverride All
    Options None
    Require all granted
</Directory>

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    I am using vhosts (assuming you’re referring to individual cPanel accounts), but I don’t see any extra config info there.

    I’m assuming this is what applies to the regular directories:

    <Directory “/”>
    AllowOverride All
    Options ExecCGI FollowSymLinks IncludesNOEXEC Indexes SymLinksIfOwnerMatch
    </Directory>

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    And I am in idiot.

    I had this in the wp-content .htaccess file:

    <Files *.php>
    deny from all
    </Files>

    So… Not sure how that got there, though it probably makes sense.
    Any recommendations on what to put there, especially to allow this file through?

    Thanks!

    digitalpoint

    (@digitalpoint)

    10 years, 11 months ago

    I don’t know anything about cPanel (I end up configuring all my stuff by hand on the shell), so not even sure where to look in that interface. But if you have shell access to your server, you might want to see about logging into it and seeing if you can just grep for “wp-content” in your config files.

    Like I said, wp-content/index.php is blocked at your web server level, but index.php up one level (in your web directory root) is not… so whatever is going on is some config that is specific to certain directories.

    One thing to check (if you didn’t already) would be to make sure something didn’t stick an .htaccess file in your wp-content folder.

    Whatever it is is *not* blocking everything, rather just PHP files within the wp-content folder (direct access, which is what the web server would control).

    Edit: Oops, looks like you beat me to checking for the .htaccess within wp-content. lol

    Thread Starter isaacl

    (@isaacl)

    10 years, 11 months ago

    See above.
    TL;DR – I’m an idiot.

    And in response to my question, I already had some code there to allow specific PHP files through, so I added this:

    <Files ~ “^(chat|loader)\.php$”>
    Order Allow,Deny
    Allow from all
    </Files>

    Assuming that should solve it.

    Thanks to you both for all your help, and I’m really sorry about that, not sure why I didn’t bother checking there earlier…

Viewing 15 replies - 16 through 30 (of 38 total)
1 2 3

The topic ‘Issue with the Better Analytics plugin’ is closed to new replies.