Access Blocker Support Thread

I have now resolved this issue with AB not working in production. It was a database problem.

My notes from the time show that I extracted all Messages keywords, sorted them. then pasted them back into the admin interface. I had done the same with blocked IP addresses and Blocked Email addresses. Some time after this AB stopped working.

I cleared all of the fields through the interface but it still didn't work.
A copy of the non-working production database did not work in test.

After turning off AB in the Admin interface and turning off logging I deleted the relevant database fields for AB (NOT RECOMMENDED WITHOUT BACKUPS).
On restarting the Admin console, AB was installed afresh. Appropriate keywords etc were added via the interface and AB was turned on.

It is now working and the log file can be read by "blocked_accesses.php"
NOTE: This work was performed and tested in a test environment before applying it to a production database that was taken offline.

Hello, I've installed this plugin but I'm getting a blank/broken index page, log states -

PHP Parse error: syntax error, unexpected '?' in ***** /includes/classes/observers/auto.access_blocker.php on line 40

I make line 40 -

        if ($this->isIpWhitelisted($_SERVER['REMOTE_ADDR'] ?? '.') === true) {

I guess that is not really an error and perhaps I need to ask for something to be updated on my server? PHP?

Could you list the requirements? Apologies if I've missed this elsewhere. The plugin looks very useful, I hope I can get it working!

Cheers

Yes, that null-coalesce operator (??) requires PHP 7.4 or later. You can make an edit to your copy by changing that line 40 to the following if you're running an earlier version of PHP:

//if ($this->isIpWhitelisted($_SERVER['REMOTE_ADDR'] ?? '.') === true) {
if ($this->isIpWhitelisted((isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] ? '.')) === true) {

Thanks :) ....that then gives me this error in the log:

PHP Parse error: syntax error, unexpected ')' in *** /includes/classes/observers/auto.access_blocker.php on line 41

Maybe it's best if I look into upgrading PHP on the server?

I'm not sure if that's possible or if it might break other areas of the site?! But I can ask my host....

Cheers

My bad. I know better than to post code before my first cup of coffee. That last ? should be a :

//if ($this->isIpWhitelisted($_SERVER['REMOTE_ADDR'] ?? '.') === true) {
if ($this->isIpWhitelisted((isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '.')) === true) {

Thank you! ...now error is unexpected '?' on line 249 which is:

    $organization = $_SESSION['ipData']->company->name ?? '';

and there is another double ?? on the line below. Sorry I can't work out what to replace that with! (I'm out of practise and not very knowledgable with PHP).

teaj:

Thank you! ...now error is unexpected '?' on line 249 which is:

    $organization = $_SESSION['ipData']->company->name ?? '';

and there is another double ?? on the line below. Sorry I can't work out what to replace that with! (I'm out of practise and not very knowledgable with PHP).

$organization = (isset($_SESSION['ipData']->company->name)) ? $_SESSION['ipData']->company->name : '';

That's why that null-coalesce is so great; makes the code much more readable!

Great, it all seems to be working now. I look forward to stopping the spammers! Thanks for your help.

Running ZC 2.1.0

Installed Access Blocker. Struggled to get email verification to work. Ended up using a different email address which then worked. (strange) Anyway, now I'm going over the settings in ZenCart Admin and noticed. (see attached) Basically it wants a user id number from the URL at AbuseIPDB which no longer displays a user ID in the URL. So this seems to be outdated and needs correction or deletion. Or the instructions updated to be useful in finding this information for the field.

lynbor:

Running ZC 2.1.0

Installed Access Blocker. Struggled to get email verification to work. Ended up using a different email address which then worked. (strange) Anyway, now I'm going over the settings in ZenCart Admin and noticed. (see attached) Basically it wants a user id number from the URL at AbuseIPDB which no longer displays a user ID in the URL. So this seems to be outdated and needs correction or deletion. Or the instructions updated to be useful in finding this information for the field.
There's no such setting for Access Blocker; perhaps you were looking for the AbuseIPDB plugin (https://www.zen-cart.com/downloads.php?do=file&id=2371%29?

lat9:

There's no such setting for Access Blocker; perhaps you were looking for the AbuseIPDB plugin (https://www.zen-cart.com/downloads.php?do=file&id=2371%29?

Shoot, my bad. Thanks for the heads up!

I installed Access Blocker and attempted to go to the ipdata dot co site, and my service provider is blocking it because they say it tracks data. I was able to get to the site by taking my phone off wi-fi and using cellular data. Just a heads up if any of you run into that.

Question--I added sectorid dot com to the host address list, and just got another attempted order from an email address on that host. I'd have thought sectorid by itself would have been enough but I entered the .com just in case. Is that the wrong place to put it?

Also, I enabled the log. Do I understand correctly that I will have to wait a month to see anything there?

HeleneWallis:

Question--I added sectorid dot com to the host address list, and just got another attempted order from an email address on that host. I'd have thought sectorid by itself would have been enough but I entered the .com just in case. Is that the wrong place to put it?

Also, I enabled the log. Do I understand correctly that I will have to wait a month to see anything there?
If you want to block all accesses using an email address of [email protected], you'll just enter @sectorid.com as one of the restricted email addresses.

Logs are written at the time an event is detected to a file whose name changes on a monthly basis.

Thanks, I missed needing to include the @ sign.

One other question--I'm still getting flooded with fraudulent attempted orders. They aren't even bothering to use real addresses (or even addresses that look genuine). I do not see how to determine the ip addresses these are coming from. I know a lot of them are coming from the same person, even though they're using different names and addresses, because most of the email addresses are redirecting to a single address. If I could get that person's ip address, I could hopefully stop them from creating new accounts every day. Is there any way in Zencart to find that or am I going to look at my host's logs?

I found the log for Access Blocker and some attempted orders were blocked. It said those orders came through guest checkout, though, and I don't even have that. So I'm not sure how anyone could be using it.

HeleneWallis:

Thanks, I missed needing to include the @ sign.

One other question--I'm still getting flooded with fraudulent attempted orders. They aren't even bothering to use real addresses (or even addresses that look genuine). I do not see how to determine the ip addresses these are coming from. I know a lot of them are coming from the same person, even though they're using different names and addresses, because most of the email addresses are redirecting to a single address. If I could get that person's ip address, I could hopefully stop them from creating new accounts every day. Is there any way in Zencart to find that or am I going to look at my host's logs?

I found the log for Access Blocker and some attempted orders were blocked. It said those orders came through guest checkout, though, and I don't even have that. So I'm not sure how anyone could be using it.
I can't remember when it was introduced, but zc210 for sure displays the IP address with which an order was placed when viewing an order's details in the admin.

lat9:

I can't remember when it was introduced, but zc210 for sure displays the IP address with which an order was placed when viewing an order's details in the admin.

Yes, but these are orders that were declined by my credit card processor. So they don't show up in ZC at all.

I looked through my configuration settings again and I see that I did install One Page Checkout at some point in the past. It is not enabled, but it does have a guest checkout option. How that is being utilized by these people I don't know, but I went into the Disallowed Pages section, where it says "Do not include the login, create_account, password_forgotten or logoff pages in this list!" and added the login and create_account pages anyway. I do not know whether that will do anything to stop these constant new accounts, since One Page Checkout is not enabled, but if they are somehow managing to access the guest checkout, perhaps that will stop them from creating new accounts. I've deleted some accounts over and over and they just keep coming back.

v2.0.0 of the Access Blocker is now available for download: https://www.zen-cart.com/downloads.php?do=file&id=2237

This release provides the plugin as a Zen Cart encapsulated one and adds handling for the password_forgotten page.

Zen Cart 2.1.0
PHP Version: 8.3.20

Upgraded from Version 1.5.2 to 2.0
Yes, ipData Service: API Key has been added
Getting the following error log

[TABLE]
[TR]
[TD][TABLE]
[TR]
[TD][02-Jul-2025 18:10:39 America/Chicago] Request URI: /index.php?main_page=login, IP address: 139.135.200.13, Language id 1
#0 /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(184): zen_debug_error_handler()
#1 /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(184): require()
#2  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(149):  zcObserverAccessBlocker->isAccessBlocked()
#3 /includes/classes/traits/NotifierManager.php(107): zcObserverAccessBlocker->update()
#4 /includes/classes/OnePageCheckout.php(415): base->notify()
#5 /includes/classes/OnePageCheckout.php(190): OnePageCheckout->initializeGuestCheckout()
#6 /includes/classes/OnePageCheckout.php(399): OnePageCheckout->guestCheckoutEnabled()
#7 /includes/modules/pages/login/header_php_login_guest.php(12): OnePageCheckout->temporaryAddressesEnabled()
#8 /index.php(40): require('/home/haremark/...')
--> PHP Warning: require(includes/classes/ipData.php): Failed to open  stream: No such file or directory in  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php  on line 184.

[02-Jul-2025 18:10:39 America/Chicago] PHP Fatal error:  Uncaught Error:  Failed opening required 'includes/classes/ipData.php'  (include_path='.:/opt/cpanel/ea-php83/root/usr/share/pear') in  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php:184
Stack trace:
#0  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(149):  zcObserverAccessBlocker->isAccessBlocked()
#1 /includes/classes/traits/NotifierManager.php(107):  zcObserverAccessBlocker->update(Object(OnePageCheckout),  'NOTIFY_OPC_GUES...', '', true, NULL, NULL, NULL, NULL, NULL, NULL,  NULL)
#2 /includes/classes/OnePageCheckout.php(415): base->notify('NOTIFY_OPC_GUES...', '', true)
#3 /includes/classes/OnePageCheckout.php(190): OnePageCheckout->initializeGuestCheckout()
#4 /includes/classes/OnePageCheckout.php(399): OnePageCheckout->guestCheckoutEnabled()
#5 /includes/modules/pages/login/header_php_login_guest.php(12): OnePageCheckout->temporaryAddressesEnabled()
#6 /index.php(40): require('/home/haremark/...')
#7 {main}
  thrown in /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php on line 184

[02-Jul-2025 18:10:39 America/Chicago] Request URI: /index.php?main_page=login, IP address: 139.135.200.13
--> PHP Fatal error: Uncaught Error: Failed opening required  'includes/classes/ipData.php'  (include_path='.:/opt/cpanel/ea-php83/root/usr/share/pear') in  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php:184
Stack trace:
#0  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(149):  zcObserverAccessBlocker->isAccessBlocked()
#1 /includes/classes/traits/NotifierManager.php(107):  zcObserverAccessBlocker->update(Object(OnePageCheckout),  'NOTIFY_OPC_GUES...', '', true, NULL, NULL, NULL, NULL, NULL, NULL,  NULL)
#2 /includes/classes/OnePageCheckout.php(415): base->notify('NOTIFY_OPC_GUES...', '', true)
#3 /includes/classes/OnePageCheckout.php(190): OnePageCheckout->initializeGuestCheckout()
#4 /includes/classes/OnePageCheckout.php(399): OnePageCheckout->guestCheckoutEnabled()
#5 /includes/modules/pages/login/header_php_login_guest.php(12): OnePageCheckout->temporaryAddressesEnabled()
#6 /index.php(40): require('/home/haremark/...')
#7 {main}
  thrown in /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php on line 184.

[02-Jul-2025 18:10:39 America/Chicago] Request URI: /index.php?main_page=login, IP address: 139.135.200.13
--> PHP Fatal error: Uncaught Error: Failed opening required  'includes/classes/ipData.php'  (include_path='.:/opt/cpanel/ea-php83/root/usr/share/pear') in  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php:184
Stack trace:
#0  /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php(149):  zcObserverAccessBlocker->isAccessBlocked()
#1 /includes/classes/traits/NotifierManager.php(107):  zcObserverAccessBlocker->update(Object(OnePageCheckout),  'NOTIFY_OPC_GUES...', '', true, NULL, NULL, NULL, NULL, NULL, NULL,  NULL)
#2 /includes/classes/OnePageCheckout.php(415): base->notify('NOTIFY_OPC_GUES...', '', true)
#3 /includes/classes/OnePageCheckout.php(190): OnePageCheckout->initializeGuestCheckout()
#4 /includes/classes/OnePageCheckout.php(399): OnePageCheckout->guestCheckoutEnabled()
#5 /includes/modules/pages/login/header_php_login_guest.php(12): OnePageCheckout->temporaryAddressesEnabled()
#6 /index.php(40): require('/home/haremark/...')
#7 {main}
  thrown in /zc_plugins/AccessBlocker/v2.0.0/catalog/includes/classes/observers/auto.access_blocker.php on line 184.

                                             [/TD]
                                                                                 [/TR]
                                 [/TABLE]
[/TD]
                         [/TR]
                                                     [TR]
                                 [TD]                                         


[/TD]
[/TR]
[/TABLE]
                                         
                                         
 

v2.0.1 of Access Blocker is now available for download: https://www.zen-cart.com/downloads.php?do=file&id=2237

This release corrects GitHub issue #26 (Receiving PHP log indicating a missing ipData.php class) and replaces v2.0.0.