Welcome Guest, Not a member yet? Register   Sign In
InvalidChars Filter - turn off logging?
#1

Hi!
I am currently using the InvalidChars Filter to help prevent spam on my site.
However, every time it seems to work, it also puts a log in the error log file. Is there anyway to remove this? I don't need to know someone submitted invalid characters- I just want to block it.
I have a contact form and it gets spammed by bots all the time (even with captcha on it). They often have some strange characters in their messages and this makes it get added to my log file.


Quote:CRITICAL - 2023-11-28 10:51:09 --> Invalid UTF-8 characters in post:
<0xa0>
in SYSTEMPATH/Filters/InvalidChars.php on line 102.
1 SYSTEMPATH/Filters/InvalidChars.php(102): CodeIgniter\Security\Exceptions\SecurityException::forInvalidUTF8Chars()
2 [internal function]: CodeIgniter\Filters\InvalidChars->checkEncoding()
3 SYSTEMPATH/Filters/InvalidChars.php(93): array_map()
4 SYSTEMPATH/Filters/InvalidChars.php(67): CodeIgniter\Filters\InvalidChars->checkEncoding()
5 SYSTEMPATH/Filters/Filters.php(184): CodeIgniter\Filters\InvalidChars->before()
6 SYSTEMPATH/CodeIgniter.php(474): CodeIgniter\Filters\Filters->run()
7 SYSTEMPATH/CodeIgniter.php(361): CodeIgniter\CodeIgniter->handleRequest()
8 FCPATH/index.php(79): CodeIgniter\CodeIgniter->run()
Reply
#2

i did my own simple class to remove chars and if they put a http link in the form it normally means their trying to sell something so i brush that off the a spam form and in that case the mesage doent get sent .

try typing in viagra into contact form of this site and see what happens https://andrinaboutique.com/
CMS CI4     I use Arch Linux by the way 

Reply
#3

(11-30-2023, 08:25 AM)captain-sensible Wrote: i did my own simple class to remove chars and if they put a http link in the form it normally means their trying to sell something so i brush that off the a spam form and in that  case the mesage doent get sent . 

try  typing in    viagra into  contact form of this site and see what happens https://andrinaboutique.com/

Yeah I feel you and could do something similar.

I mostly turned on InvalidChars filter tho because I got someone running a tool on every input on my site using all sorts of strange characters to try and find vulnerabilities. Since I enabled this filter it's completely stopped it.

Can you share your filter for invalid chars? Maybe it's similar to the one CI provides.
Reply
#4

Extend the InvalidChars filter, and customize it.
Reply
#5

(12-03-2023, 07:19 PM)kenjis Wrote: Extend the InvalidChars filter, and customize it.

Hmm, so something like this?

PHP Code:
class FixInvalidChars extends InvalidChars
{
 protected function 
checkEncoding($value)
    {
        if (is_array($value)) {
            array_map([$this'checkEncoding'], $value);

            return $value;
        }

        if (mb_check_encoding($value'UTF-8')) {
            return $value;
        }

        return '';
        //throw SecurityException::forInvalidUTF8Chars($this->source, $value);
    }


Since throwing the exception auto-logs it, I guess just comment it out and return a value of empty.
Reply
#6

No, return a response.
https://codeigniter4.github.io/CodeIgnit...g-response
See the Throttle code.
https://codeigniter4.github.io/CodeIgnit...l#the-code

A request with invalid characters are a bad request, so you should not need to process it.
Reply




Theme © iAndrew 2016 - Forum software by © MyBB