If the "User Agent" is blank then give the "User Agent" the name "blank"

If the "User Agent" is blank then give the "User Agent" the name "blank".... this will allow those who consider blank user agents as spiders to better see the true customer traffic on the site.

The area of code that seems to be in question here is this:

  $user_agent = '';
  if (isset($_SERVER['HTTP_USER_AGENT'])) {
    $user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
  }
  $spider_flag = false;
  if (zen_not_null($user_agent)) {
    $spiders = file(DIR_WS_INCLUDES . 'spiders.txt');
    for ($i=0, $n=sizeof($spiders); $i<$n; $i++) {
      if (zen_not_null($spiders[$i]) && substr($spiders[$i], 0, 4) != '$Id:') {
        if (is_integer(strpos($user_agent, trim($spiders[$i])))) {
          $spider_flag = true;
          break;
        }
      }
    }
  }
  if ($spider_flag == false) {
    zen_session_start();
    $session_started = true;
  } else {
    if (isset($_GET['zenid']) && $_GET['zenid'] != '') {
      $tmp = (isset($_GET['main_page']) && $_GET['main_page'] != '') ? $_GET['main_page'] : FILENAME_DEFAULT;
      @header("HTTP/1.1 301 Moved Permanently");
      @zen_redirect(@zen_href_link($tmp, @zen_get_all_get_params(array('zenid')), $request_type, FALSE));
      unset($tmp);
      die();
    }
  }

It seems like the request is to always check against the spiders.txt file although that won't work if the $user_agent is identified as empty '' or 'blank' because the reason it is set to empty or 'blank' is because there is no user_agent identifier.

Are you saying that normal users always have a user_agent set, but bots do not and therefore if a user_agent is not set that the individual visiting should be prevented from going through the purchase cycle?

Or do you have another test factor that if there is no user_agent then there is some other piece of information that would identify the visitor as a spider (or not a spider)?

mc12345678:

Are you saying that normal users always have a user_agent set, but bots do not and therefore if a user_agent is not set that the individual visiting should be prevented from going through the purchase cycle?

Or do you have another test factor that if there is no user_agent then there is some other piece of information that would identify the visitor as a spider (or not a spider)?

In 100% cases where I have seen a 'blank' user_agent, it was a nefarious bot or someone entering questionable strings; not someone just casually browsing. Not sure I would call the visitor a spider.

Reason why I would want to call a spider is so that they are definitely not a customer... and would not to see their sessions info in daily session info as they can spend some time trying various none existing urls :)

Also, if they were given the user agent id of "blank" it would be up to us to enter or remove from the spider.txt file.

Customers and for the most part spiders all have something in the user agent field.... so this would imply... yes... that they are probably a no-gooder and trying to hack

I currently (zc154) use DrByte's Bad Bot Block plugin to take care of the user_agents that insist on attempting bad stuff or just camp, and camp, and camp

https://www.zen-cart.com/downloads.php?do=file&id=1854

Just create a clone for each 'bad bot'. Not sure if it plays nice in 156b.