Why is SPAM still getting through security question?

Since the publication of the form, SPAM is still getting through even though I'm using a security question. I cannot use Captcha because it seems to conflict with other forms that are posted within the same page using Captcha.

I've tried using the blocking of specific IP addresses using this suggestion, but SPAM from the IP array is still getting through. Unless I'm putting this script in the wrong place?

The script I'm using is this:

<?php
$banned_ips = array(
  '46.151.53.0',
  '6.151.53.255',
'46.151.52.61 '
);
$ip_address = JRequest::getString( 'REMOTE_ADDR', '', 'server' );
if ( in_array($ip_address, $banned_ips) ) {
  $mainframe->redirect('http://www.ic3.gov/default.aspx');
}
?>

This custom code is posted before the 'Handle Arrays' action in the OnSubmit event. Plus, is there any way to create an array of IPs instead of posting just individual IPs with this code?

Hi toad,

It may need updating for some Joomla! changes. Pleas try this version:

<?php
$banned_ips = array(
  '46.151.53.0',
  '6.151.53.255',
  '46.151.52.61'
);
$ip_address = JRequest::getString( 'REMOTE_ADDR', '', 'server' );
if ( in_array($ip_address, $banned_ips) ) {
  $app = \JFactory::getApplication();
  $app->redirect('http://www.ic3.gov/default.aspx');
}
?>

Note: i removed a stray space from one of the IP addresses.

Yes, you can adapt the code to work with a block - I think someone posted a version here a few months ago.

Use your own IP address in the array to test if this is working.

And validation actions like this should be at or near the top of the On Submit event before anything that sends emails, saves, etc.

Bob

Okay, I've made the modification your posted. I've also added my own IP, but was still able to get access to the page/site. The form is within a module, if that makes any difference. I've also disabled any security tools to further test the blocking of my IP, and still can access the form.

I suppose I'll let this ride out and monitor any more incoming messages from this form to see if your modification above works.

Hi toad,

Something odd is happening if you aren't seeing redirection with your own IP address. Please take a Form Backup using the icon in the Forms Manager and post it here and I'll take a closer look.

Bob

Here it is.

Hi toad,

It's working OK on my test site. Perhaps your server somehow doesn't make the IP address available? This version of the code has a couple of lines of debug code added (and the redirect commented out).

<?php
$banned_ips = array(
  '46.151.53.0',
  '6.151.53.255',
  '46.151.52.61',
  '208.89.39.51',
);
$ip_address = JRequest::getString( 'REMOTE_ADDR', '', 'server' );
  echo'<div>$ip_address: '.print_r($ip_address, true).'</div>';
  if ( in_array($ip_address, $banned_ips) ) {
  $app = \JFactory::getApplication();
  echo'<div>$ip_address: banned</div>';
  //$app->redirect('http://www.ic3.gov/default.aspx');
}
?>

You should see the IP Address displayed and a 'banned' message if it is matched.

Bob

Well I don't see any 'Banned' message when I load your code, so maybe it's the hosting server. What I'll do is add some more IPs and see how things go for the next week or so.

Thank you for the lesson. I might take on the challenge of creating an IP array instead of updating this code with individual IPs.