Support

Admin Tools

#23133 Custom ban page

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by tampe125 on Thursday, 20 August 2015 09:32 CDT

Ch3vr0n
 For the first time in a long time again i have a persistant ukrainian sucker trying to get into my belgian site.admin pannel. Auto ban was set after 3 attacks in 1 day, ban for 24. The person triggered it after 6 with 2h intervals.

Currently the WAF shows a basic text message in the trend of "go away bad person" :p.

Now i was wondering, is there a way to "spruce" things up a little like you can with custom error pages? I want those suckers to have something "nice" to look at, like by using the front side template, or with custom html code.

Is this possible or could it be added? If yes, you'd make me a happy camper but i won't ask for a timeline. Just would be happy to see it at some point.

tampe125
Akeeba Staff
Hello Wirm,

custom error message is something that won't be implemented.
Creating a "nice" page, using your Joomla template will consume a lot of resources and most likely you'll cause a Denial Of Service on your own site.
Since 90% of those attacks are automated, the best thing to do is to simply display a "you're blocked" message and stop the execution. In this way you can use your server resources for users that really care about your site.

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ch3vr0n
I can understand a joomla template one isn't doable, but a "nice" one using some basic html should be doable like is possible with custom error pages. I don't see see how such a page could cause a dos attack. banned is banned. All i want to do is give them something nice to look at (image with a little text :p)

tampe125
Akeeba Staff
You can customize the error page using the instruction contained in this page, in the section WAF: Security exception message customisation

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ch3vr0n
awesome how could i have overlooked that. Seems just like what i want. imma get to work ^^

Though if i can make a suggestion for improvement, i'd make it possible to add the html code from within AT with a preview option. Upon "save", it would then create the file and save it in the appropriate directory.

tampe125
Akeeba Staff
Joomla already does that: you can create template overrides directly inside the template manager.

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ch3vr0n
Bare with me. We'll get there eventually

I'm in template manager > modify template > click on "preview" joomla shows me a red page "access denied", rather fancy looking but that's probably not where i want to be right?

However clicking on "preview" seemt to have triggered a security exception. I'll add that message at the bottom.

so i click on
1) "<templatename> data and files"
2) tab "create overrides"
3) clicked under column "components" on "com_admintools" and then blocks
4) was alerted with a green message

Override created in /templates/<templatename>/html/com_admintools/blocks

Creation of override succesful

I suppose that's what i want, and all i need to do now is log into FTP, download that file, make my customisations and upload it again?
----------------
Security exception:

Hello,
We would like to notify you that a security exception was detected on your site, <sitename>, with the following details:
IP Address: <my ip address> (IP Lookup: IP Lookup)
Reason: template= in URL
If this kind of security exception repeats itself, please log in to your site's back-end and add this IP address to your Admin Tools's Web Application Firewall feature in order to completely block the misbehaving user.
Best regards,


The exceptions log shows:

2015-08-19 14:31:29 <my ip> template= in URL <domain>/index.php?tp=1&template=protostar
2015-08-19 14:30:30 <my ip> template= in URL <domain>/index.php?tp=1&template=<templatename>

But if i'm right thats due to having enabled "visual fingerprint security" and both "block tmpl=foo system template change" and "block template=foo website template change"

which one would i need to disable again for "preview" to work" or would you recommended i leave them enabled?

tampe125
Akeeba Staff
I suspect the integrate way it raising some security exceptions.
Please try the manual way as described in the documentation.

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ch3vr0n
i did. That's what i said. The manual instructs how to do it manually, but the override creator did that automatically. The default.php file was created in the proper folder i think. I just want to make sure.

/public_html/templates/<templatename>/html/com_admintools/blocks

The content of that default.php indicates a standard Error 403 forbidden, and not the "You are a spammer, hacker or an otherwise bad person." I just want to make sure it's the proper file

and

You're not reading what i'm saying, and ya skipped the part about what i need to (temp disable) to have the preview working again entirely.

tampe125
Akeeba Staff
I'm sorry for missing your reply, yesterday was a very busy day I just overlooked to your reply, I'm sorry for that.

You can display the HTML message using the template override for users triggering a security exception.
Banned users will see a different message, the You are a spammer.... You can't display any "page" or complex message, for performance reasons.
What you can do is to create a static HTML page, not inside Joomla (the user was just blocked) and then update the "banned message" to display a link to such page.
If you plan to do that, please install the latest dev release, otherwise you wouldn't be able to save HTML code inside the banned message.

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Ch3vr0n
display a link to that page. Don't think the hacker wannabe will click on it.

Still not reading what i'm saying

I just want to make sure it's the proper file


Is that, or isn't that the proper file to edit?

You're saying that page can show the "you're a spammer..." message too so i'm fine with editing that one. I'll have a look at the alpha, but not going to use an alpha release on a live site. Security & stability reasons, sure u understand

tampe125
Akeeba Staff
Yes, that's the correct file to edit.

Davide Tampellini

Developer and Support Staff

๐Ÿ‡ฎ๐Ÿ‡นItalian: native ๐Ÿ‡ฌ๐Ÿ‡งEnglish: good โ€ข ๐Ÿ• My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!