Access Blocker Support Thread

Is is possible (whether in an upcoming version or just for us individually) to add a MESSAGE to a blocked user to inform them about the block?

Here's why. A lot of legitimate customers may be accessing the ZenCart store from a shared IP (like at University's or other public access points).

Many of these public access points might actually be banned due to malicious activity from other users. But the legit customer using that same network might not be aware of it.

So when a customer is sending us a message through the Contact Us page, the plugin gives the impression that their message was sent (which is by design), but the legit customer will have no idea that we never got it because it was blocked due to their IP.

I am wondering if we can just display a configurable message that says something like, "WARNING - Your message has NOT been delivered due to your network being BLOCKED for prior malicious activity."

Of course, being configurable, a store owner can choose to offer other ways to contact them to communicate, like calling a store phone number or emailing them directly from their email address, etc.

Jeff_Mash:

Is is possible (whether in an upcoming version or just for us individually) to add a MESSAGE to a blocked user to inform them about the block?

Here's why. A lot of legitimate customers may be accessing the ZenCart store from a shared IP (like at University's or other public access points).

Many of these public access points might actually be banned due to malicious activity from other users. But the legit customer using that same network might not be aware of it.

So when a customer is sending us a message through the Contact Us page, the plugin gives the impression that their message was sent (which is by design), but the legit customer will have no idea that we never got it because it was blocked due to their IP.

I am wondering if we can just display a configurable message that says something like, "WARNING - Your message has NOT been delivered due to your network being BLOCKED for prior malicious activity."

Of course, being configurable, a store owner can choose to offer other ways to contact them to communicate, like calling a store phone number or emailing them directly from their email address, etc.
Good idea. I've created a GitHub issue for tracking the change: https://github.com/lat9/access_blocker/issues/32

I am looking to avoid spam on my forms and found this cool plugin.

I just want to make sure I understand how this module works. And if anyone has any recommendations on the settings.

Based on my settings below it should block all users based on "block by country" setting.
Does the ipData also block Users?

I do see that the ipData is active.

Does anyone have any recommendations on what countries to block?

My settings:

Enable Access Blocker?            True
ipData Service: API Key 		         xxxxxxxxxx
Use ipdata.co EU Endpoint?		 False
Totally restrict access on threats? 	 False
Block by Country:  			         ZW,MK,RU,UA,VN,BG,IR,GA,TR,IN,TH,PK,LY,SY,SD,CN

chadlly2003:

I am looking to avoid spam on my forms and found this cool plugin.

I just want to make sure I understand how this module works. And if anyone has any recommendations on the settings.

Based on my settings below it should block all users based on "block by country" setting.
Does the ipData also block Users?

I do see that the ipData is active.

Does anyone have any recommendations on what countries to block?

My settings:

Enable Access Blocker? True
ipData Service: API Key xxxxxxxxxx
Use ipdata.co EU Endpoint? False
Totally restrict access on threats? False
Block by Country: ZW,MK,RU,UA,VN,BG,IR,GA,TR,IN,TH,PK,LY,SY,SD,CN

I don't understand the highlighted question.  Based on the above settings, any attempt to send a contact-us (or ask-a-question) email or create an account will be blocked from doing so, if their IP address points back to one of those countries.

Access Blocker v2.0.3 is now available for download: [https://www.zen-cart.com/downloads.php?do=file&id=2237

](https://www.zen-cart.com/downloads.php?do=file&id=2237)This release contains changes for these GitHub issues:

#35: curl_close is deprecated in PHP 8.5; not needed for PHP 8.0 and later.
#34: Add company's ASN to the values that can be blocked when blocking by company.
#33: Ensure that OPC guest-checkout email-addresses are blocked, if configured.
#32: Add notifications to enable a message override when a threat is detected

lat9:

Good idea. I've created a GitHub issue for tracking the change: https://github.com/lat9/access_blocker/issues/32

Cindy - You mentioned in this update that in order to display a message on the Contact Us page:

ask_a_question and contact_us pages: You'll need to check the above, since the access-blocker simply redirects to the page with 'action=success'

Can you explain more about that, and what we need to do to enable a message on the Contact Page when access is blocked?

The main reason for the initial feature was to notify customers on the Contact Us page that their message to us was NOT getting through (due to access blocking), so that they wouldn't think that we were ignoring them.

I just need to know what we should put in the code to redirect to a message instead of the zen_redirect(zen_href_link(FILENAME_CONTACT_US, 'action=success', 'SSL'));

Jeff_Mash:

Cindy - You mentioned in this update that in order to display a message on the Contact Us page:

Can you explain more about that, and what we need to do to enable a message on the Contact Page when access is blocked?

The main reason for the initial feature was to notify customers on the Contact Us page that their message to us was NOT getting through (due to access blocking), so that they wouldn't think that we were ignoring them.

I just need to know what we should put in the code to redirect to a message instead of the zen_redirect(zen_href_link(FILENAME_CONTACT_US, 'action=success', 'SSL'));

For both the contact_us and ask_a_question pages, the associated language file contains TEXT_SUCCESS, which defaults to "Your message has been successfully sent.". You'll need to make a template-override copy of the message file, e.g. /includes/languages/english/YOUR_TEMPLATE/lang.contact_us.php, and make your edits there.

smcelligott:

disabled new account e-mail confirmations,
I'm running ZC 2.1.0 and I'm wondering how I disabled new account e-mail. In a perfect world I would like to be able to approve emails to be sent and not be auto generated for new customers.
This Access Blocker not work for my Scrip Kiddy cuz it is being generated from an AI source. IP address, country, domains are always different, My biggest problem is emails are being sent from my domain and that is effecting my emails credibility and I'm getting black listed. They are getting some good emails from somewhere

lat9:

For both the contact_us and ask_a_question pages, the associated language file contains TEXT_SUCCESS, which defaults to "Your message has been successfully sent.". You'll need to make a template-override copy of the message file, e.g. /includes/languages/english/YOUR_TEMPLATE/lang.contact_us.php, and make your edits there.

Cindy - Wouldn't modifying the TEXT_SUCCESS simply display the same text for everyone though (successfully delivered messages to legit customers, and for access blocked messages)?

In other words, shouldn't there be a different message that you display for blocked messages (something like TEXT_BLOCKED) that would be defined in the language file?

It sounds like if I create an override file (in store/includes/languages/english/bootstrap) and modify the text for TEXT_SUCCESS, then that's going to still display the same "success" message for both blocked and non-blocked messages that were submitted.

Am I missing something here?

OK, I see your point. How about I make an update that uses a different "success" message on the ask-a-question and contact-us pages if the "successful" redirect is based on a blocked access?

GitHub tracking issue: https://github.com/lat9/access_blocker/issues/39

lat9:

OK, I see your point. How about I make an update that uses a different "success" message on the ask-a-question and contact-us pages if the "successful" redirect is based on a blocked access?

GitHub tracking issue: https://github.com/lat9/access_blocker/issues/39

Yes, that is exactly what I was originally trying to (poorly) communicate. The point being that if a user's submitted message is blocked, then we want them to know that it was blocked. So upon a blocked access, we need a separate configurable define message so that we can inform them.....like "MESSAGE NOT DELIVERED: It looks like your location is being blocked from delivering messages to us, so we will not get your original message. If you think this is in error and need to reach us, send a separate email to us at [email protected] and let us know."

This is separate from the usual TEXT_SUCCESS message that will be displayed for messages submitted by non-blocked access.

Thanks for adding it to the repo!

Jeff_Mash:

Yes, that is exactly what I was originally trying to (poorly) communicate. The point being that if a user's submitted message is blocked, then we want them to know that it was blocked. So upon a blocked access, we need a separate configurable define message so that we can inform them.....like "MESSAGE NOT DELIVERED: It looks like your location is being blocked from delivering messages to us, so we will not get your original message. If you think this is in error and need to reach us, send a separate email to us at [email protected] and let us know."

This is separate from the usual TEXT_SUCCESS message that will be displayed for messages submitted by non-blocked access.

Thanks for adding it to the repo!
Of course, publishing that email address to someone who's possibly a threat just says that the email address could be heavily spammed ... which is the whole point of blocking the access. Perhaps have them phone instead?

lat9:

Of course, publishing that email address to someone who's possibly a threat just says that the email address could be heavily spammed ... which is the whole point of blocking the access. Perhaps have them phone instead?

Of course.....Whatever works. Sometimes when publishing front-facing email addresses, we just use a generic "gmail.com" account that we create for the purpose of contacting us via email, something that we don't mind if it gets spammed or not (like OurDomainUnblockMe######################) But yes, a phone number also works. Since the message would be configurable, the store owner can modify it to whatever works best.