Eli
Forum Replies Created
-
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Stopped updatingYeah, I’m not sure where you are seeing that but that is not enough information to help diagnose the cause of this issue.
The error_log files will have detailed information about what script was being executed when the error was triggered and usually even points to what line of code triggered this error. That is what we need to see.
A 406 error generally mean “Not Acceptable”, which does indicate that your server is blocking the request for some reason. Hopefully your error_log file will have more info but you could also ask your hosting provider about this to see if there is some reason that they would be blocking this URL from Posting the update data to your website.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Stopped updatingSure, anything is possible, but I don’t think that litespeed has anything directly to do with the problem you are having. It is most likely a conflict with some other code on your site, or a restriction on the server that is preventing certain URLs, or else a configuration issue. But the only way to be sure of what the problem is and figure out what is causing it is to find the relevant error in the error_log files.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Stopped updatingAre you saying that you are unable to download the latest definition updates?
Could this empty page that you are seeing be caused be a 500 error that might be explained my examining the error_log files on your server?
I cannot say what might be causing this without more information but I am willing to help you figure out that cause and find a solution if you can check the log files and produce any relevant error messages that might help us to understand the problem better.
The scan feature is currently a manual process that requires you to actively run the scan in order to look for any infections present in the files or database. However, there are also the firewall features and the optional Brute-Force Protection that are actively protecting your site at all time while enabled.
The definitions are stored in the wp_options table with the option_name of “GOTMLS_definitions_blob” and currently use about 191KB of space, or around 518KB if you also have the Core File Definition (included with automatic updates). With each new definition added it might increase the definition size by anywhere from 200 bytes to 1,500 bytes, though many of the updates are only changes to existing definition and not additions of new ones, so those can be very small or even sometime smaller than the former definition (in which case the update will reduce the overall size of the definitions.
In short, these definition updates take up an significant amount of space in your database. The GOTMLS_definitions_blob will be automatically deleted from your database when you deactivate the plugin, and you can always download the latest definitions from within the plugin if you reinstall it.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Update disallows loginThanks for the followup. I would like to fix this today if possible but I may need more help from you to narrow down the cause. As mentioned I had thought that this issue was already fixed in my latest release, as all those who reported the issue with 4.23.56 also confirmed that it was fixed in 4.23.57, but if you are still having a similar issue then I need to take another look.
Is there any can provide me with more details to help me narrow down the cause? Perhaps this issue is only present on a subset of the sites on your server and not all, or maybe there is another reason the sessions suddenly stopped working on your server (like a read-only filesystem in the the temp directory where session files are written, or the temp partition is out of free space). Can you please contact me directly with any details that might help me troubleshoot this issue?
eli AT gotmls DOT net
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Update disallows loginYes, there was a potential conflict with the Session changes in the Brute-Force Protection released in version 4.23.56 on Saturday. That is why I released another update on Sunday, version 4.23.57 should solve this issue for you.
Please download the latest version and let me know if you have any further issues.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Register key does not workHi Dario,
I’m not sure what caused the delay but I can see from my sent mail that the email was sent to your gmail address about 2 minutes after you posted this topic on the support forum. I can also see that your account is now registered to that same email, so it looks like everything went though fine (just a couple minutes later than expected).
Also, if you are having any kind of issues with my website or account registration then you should contact me directly or at least post it on my website, not on the public WordPress forum.
Please email me directly if you have any more questions about your account:
eli AT gotmls DOT net
This error message suggests that the plugin was unable to scan or read the files in the …/uploads/2023/11 folder. The permissions listed there don’t seem to be the problem so I would guess that this has something to to with a memory limit or timeout issue on the server. There may be an unusually large number of file in that directory which could be contributing to the resource limit problem. You could try increasing the memory_limit value in the php.ini file on your server to allow PHP processes (like my plugin) to use more memory when scanning each folder.
Thanks again for your post. I have just updated my definitions to exclude this False Positive.
Please download the latest definition (NB34u) to confirm that this file is no longer flagged as a Known Threat.
Thanks for reporting this to me. I have confirmed that this is in fact a False Positive, and I will be whitelisting it ASAP.
In case you (or the developers) want to know why it was flagged, it was the usage of a variable function ($result) called inside a condition that was testing a $_REQUEST parameter. I can see now that those conditions are not always malicious even though it is a common pattern among malicious injections. What makes this particular usage of a variable function safe is that the $result() function was declared inside the Class Function that calls it, so scope is limited, and the variable function is not passed by the unrelated $_REQUEST parameter being validated in the surrounding condition.
I’m not sure why the developers chose to use a variable function like $result = function(… when they could have just declared the function properly, and there is always the potential to open up a security vulnerability if there is any chance that the variable can be altered before it is called, but in this case I can see no threat here so I will update my definitions to allow for this usage.
Forum: Plugins
In reply to: [Anti-Malware Security and Brute-Force Firewall] Found 8 Known ThreatsIt’s hard to see exactly what threat was found because of how your pasted content got formatted when you posted it on this forum.
I understand that the scan “Found 8 Known Threats” like this one, but was there a problem or a question that prompted you to post this info?
Ok, Thanks for the details. I have released a plugin update that should fix this issue. If you have the opportunity to try it again, on this or any other site, then please let me know how it works for you.
Thank you for reporting these details. I think I have found the cause of this but I cannot recreate the error on any of my test sites, can you please send me a screenshot of the Anti-Malware Setting page in your wp-admin?
I also noticed in your screenshot that the scan found 1215 Known Threats, so I thought it would be helpful to point out that you can still go ahead and fix those threats that have already been found without waiting for the Complete Scan to finish. It may improve the speed and effectiveness of the scan to have those threats removed, and that may also decrease the CPU usage that GoDaddy is complaining about. Or you could just move your site to a better hosting provider where you hopefully will not have any more of these issues 😉
- This reply was modified 2 years, 11 months ago by Eli.