ZX AntiSpam [Support Thread]

This plugin (pending approval) will attempt to capture spam account registration based on a set of rules. If it detects a possible spam account, it will create a temporary account for that customer and will send out an email with a unique token for the customer to confirm their account. If they confirm the account, a real account is created for them and they can continue shopping. If they don't confirm it (which is usually the case with spam accounts because they use fake email addresses), their temporary account will be deleted - you can control how long to keep the confirmation active.

At the moment, the only rules available are to detect the number of capital letters in first and last name, street address and city. These were the only common factors I've noticed so far. New rules can be added - just submit your ideas.

You can set the plugin's Mode to "always" so ALL accounts require email confirmation before they can access your store. Keep in mind this is an unwelcome feature in ecommerce and you might lose sales because of it, but it's up to you to decide if you really need/want it.

You can also manually approve a customer from the admin->Customers->Customers Spam, as well as edit any details or delete the request.

Once approved, it can be downloaded at:
ZX AntiSpam and Email Verification Required 1.0

I would suggest a rule that flags account sign-ups that have "google" as the company name. That seems to be the major constant on all the spam accounts that we have signing up.

That's a simple rule to add, but do you think this will help in the long run? They'll change it to bing and then what? In your case, how often do people actually use the company field? Would it be more productive if all entries with anything in the company name was flagged?

In our case, it does seem like "google" is used all the time in the company field. We do have good customers that use the company field, so flagging it in general wouldn't be great for us.

Mine are always Bing, Apple, AT&T fwiw.

I've just submitted an update which includes company and country verification (both optional). It allows you to enter a list of "spam" company names, as well as a list of "allowed" countries. If you're based in the US and someone is creating an account with "Algeria" as their country, chances are it's a fake account - you can now define a list of allowed countries (usually just a few), and all other countries will need to verify their email before being able to register.

Until approved, the plugin can be downloaded from my website.

New update just submitted - added option to check the user's IP address and match country, state and city based on IP address. It also allows to check if user is behind a proxy, and if the IP is listed as a threat. The service requires an API key, but it's free for up to 10.000 lookups per month. Since the lookup is initiated only during the account creation process, this should be more than enough - it's highly unlikely that you'll have more than 10k signup attempts per month. And, if you actually do, this would mean you run a super-busy store and will easily be able to afford the paid plans... :smile:

[ZC 1.5.8][PHP 8.0][MySQL 10.3]

May 'customers_referral' default be set to NULL

--> PHP Fatal error: 1364:Field 'customers_referral' doesn't have a default value :: INSERT INTO bd_customers_spam (customers_firstname, customers_lastname, customers_email_address, customers_nick, customers_telephone, customers_fax, customers_newsletter, customers_email_format, customers_default_address_id, customers_password, customers_authorization, customers_gender, entry_gender, customers_dob, entry_street_address, entry_postcode, entry_city, entry_country_id, entry_company, entry_suburb, entry_zone_id, entry_state, token, token_manual, reason) VALUES (...) ==> (as called by) /httpd.www/includes/classes/observers/auto.zx_antispam_observer.php on line 154 <== in /httpd.www/includes/classes/db/mysql/query_factory.php on line 667.

Users of this may also want to look at Delete Spam Customers.
https://www.zen-cart.com/downloads.php?do=file&id=2253

There is also this kind of error in [ZC 1.5.8] (using Bootstrap template):

[13-Mar-2023 14:55:07 UTC] Request URI: /index.php?main_page=account_confirmation, IP address: 
--> PHP Fatal error: Uncaught Error: Call to a member function isMobile() on null in /httpd.www/includes/templates/template_default/templates/tpl_account_confirmation_default.php:16
Stack trace:
#0 /httpd.www/includes/templates/bootstrap/common/tpl_main_page.php(202): require()
#1 /httpd.www/index.php(94): require('/httpd.www/...')
#2 {main}
  thrown in /httpd.www/includes/templates/template_default/templates/tpl_account_confirmation_default.php on line 16.

Any ideas?

zamzom:

[ZC 1.5.8][PHP 8.0][MySQL 10.3]

May 'customers_referral' default be set to NULL

zamzom:

There is also this kind of error in [ZC 1.5.8] (using Bootstrap template):

[13-Mar-2023 14:55:07 UTC] Request URI: /index.php?main_page=account_confirmation, IP address:
--> PHP Fatal error: Uncaught Error: Call to a member function isMobile() on null in /httpd.www/includes/templates/template_default/templates/tpl_account_confirmation_default.php:16
Stack trace:
#0 /httpd.www/includes/templates/bootstrap/common/tpl_main_page.php(202): require()
#1 /httpd.www/index.php(94): require('/httpd.www/...')
#2 {main}
thrown in /httpd.www/includes/templates/template_default/templates/tpl_account_confirmation_default.php on line 16.

> 
> Any ideas?
What plugin provided that **account_confirmation** page?  It's not a standard Zen Cart page.

lat9:

What plugin provided that account_confirmation page? It's not a standard Zen Cart page.

It is the ZX AntiSpam plugin.
It is the page where the confirmation code is entered.
It worked fine when I have removed that line where IsMobile check is made, because I have recognized there is no such check on other similar template pages. This was the line:

<?php 
  if (!isset($display_as_mobile)) $display_as_mobile = ($detect->isMobile() && !$detect->isTablet() || $_SESSION['layoutType'] == 'mobile' or  $detect->isTablet() || $_SESSION['layoutType'] == 'tablet'); 
?>

I have also made the rest look like the Bootstrap template way.
However there are many other issues with ZC 1.5.8.
To be continued to list them here...

In customers_spam.php around line 860

                <?php
                if ($error == true) {
                  if ($entry_country_error == true) {
                    echo zen_draw_pull_down_menu('entry_country_id', zen_get_countries_for_admin_pulldown(), $cInfo->entry_country_id, 'class="form-control"') . ' ' . ENTRY_COUNTRY_ERROR;
                  } else {
                    echo zen_get_country_name($cInfo->entry_country_id) . zen_draw_hidden_field('entry_country_id');
                  }
                } else {
                  echo zen_draw_pull_down_menu('entry_country_id', zen_get_countries_for_admin_pulldown(), $cInfo->entry_country_id, 'class="form-control"');
                }
                ?>

zen_get_countries() function is called. This invokes an error. It works fine if these are replaced by zen_get_countries_for_admin_pulldown() function as above.

Has anyone actually been using this addon? There are some really strategical errors! Check this out:

In /includes/modules/pages/account_confirmation/header_php.php around line 97

        $sql = "UPDATE " . TABLE_CUSTOMERS . "
              SET customers_default_address_id = '" . (int)$address_id . "'
              WHERE customers_id = '" . (int)$_SESSION['customer_id'] . "'";

        $db->Execute($sql);

        $sql = "INSERT INTO " . TABLE_CUSTOMERS_INFO . "
                          (customers_info_id, customers_info_number_of_logons,
                           customers_info_date_account_created, customers_info_date_of_last_logon)
              VALUES ('" . (int)$_SESSION['customer_id'] . "', '1', now(), now())";

        $db->Execute($sql);

$sql variable used for db input string. However the same variable is used elsewhere for db output array(assigned around line 40 in the code), and around line 118 it is tried to be read again, of course after it is being corrupted:

        $_SESSION['customer_first_name'] = $sql->fields['customers_firstname'];
        $_SESSION['customer_last_name'] = $sql->fields['customers_lastname'];
        $_SESSION['customer_default_address_id'] = $address_id;
        $_SESSION['customer_country_id'] = $sql->fields['entry_country_id'];
        $_SESSION['customer_zone_id'] = $sql->fields['entry_zone_id'];
        $_SESSION['customers_authorization'] = $sql->fields['customers_authorization'];

Should have used some other string variable for the former, for example $sql_str

Also includes/modules/pages/account_confirmation/header_php.php makes uses of variables such as EMAIL_GREET_MS etc. which are available to the standard create_account page. However in ZC 1.5.8 these are not loaded on every page.
Is there a neat way to load these variables on account_confirmation page?
Or do we have to redeclare them here again?

#6  require(/httpd.www/includes/modules/pages/account_confirmation/header_php.php) called at [/httpd.www/index.php:35]
--> PHP Fatal error: 1292:Incorrect datetime value: '1-01200-' for column `mystore_com`.`db_customers`.`customers_dob` at row 1 :: INSERT INTO db_customers (customers_firstname, customers_lastname, customers_email_address, customers_nick, customers_telephone, customers_fax, customers_newsletter, customers_email_format, customers_default_address_id, customers_password, customers_authorization, customers_gender, customers_dob) VALUES (..., '1-01200-') ==> (as called by) /httpd.www/includes/modules/pages/account_confirmation/header_php.php on line 62 <== in /httpd.www/includes/classes/db/mysql/query_factory.php on line 667.

Customer's DOB is reversed, I think no need to call zen_date_raw here (around line 60 of header_php.php):

        if (ACCOUNT_DOB == 'true')  $sql_data_array[] = array('fieldName'=>'customers_dob', 'value'=>empty($sql->fields['customers_dob']) || $sql->fields['customers_dob'] == '0001-01-01 00:00:00' ? zen_db_prepare_input('0001-01-01 00:00:00') : zen_date_raw($sql->fields['customers_dob']), 'type'=>'date');

zamzom:

[ZC 1.5.8][PHP 8.0][MySQL 10.3]

The bold part is where your problem lies. I haven't updated this plugin for 1.5.8 (nor php 8.x) and at the moment have no plans for it.

The plugin works fine on 1.5.7 (it was built on request by one of my clients and used by multiple) but needs a thorough code review for 1.5.8 because of all the changes introduced in that version.

balihr:

The bold part is where your problem lies. I haven't updated this plugin for 1.5.8 (nor php 8.x) and at the moment have no plans for it.

The plugin works fine on 1.5.7 (it was built on request by one of my clients and used by multiple) but needs a thorough code review for 1.5.8 because of all the changes introduced in that version.

I know. I am sharing all these so that they would guide you or the others who makes changes.
Btw, thanks for your efforts to share such a plugin. I think it was a big shortage for ZC. Nowadays, e-mail validation or even a phone number validation is a standard procedure for web-sites.

Note: My remarks on 14 Mar 2023, 08:50 PM #14 is independent of the ZC or PHP version though. I think it should be corrected for the current ZX AntiSpam version.

zamzom:

Also includes/modules/pages/account_confirmation/header_php.php makes uses of variables such as EMAIL_GREET_MS etc. which are available to the standard create_account page. However in ZC 1.5.8 these are not loaded on every page.
Is there a neat way to load these variables on account_confirmation page?
Or do we have to redeclare them here again?

Checking from the documentation
https://docs.zen-cart.com/dev/code/158_language_files/

I have inserted the following in the beginning of header_php.php file after the require(DIR_WS_MODULES ... statement on line 14:

 $filename = 'create_account.php';    // load extra language constants from create_account page
  $folder = '/';  // end with slash 
  $new_langfile = DIR_WS_LANGUAGES . $_SESSION['language'] . $folder .  'lang.' . $filename; 
  if (file_exists($new_langfile)) {
     global $languageLoader; 
     $languageLoader->loadExtraLanguageFiles(DIR_FS_CATALOG . DIR_WS_LANGUAGES,  $_SESSION['language'], $filename, $folder); 
  }

Hi balihr,

Is there any plans to update this plugin or will it work with Zen Cart v.2.1.0 and PHP8+??

The email verification seems to be a great tool. Have had the bots creating thousands of new accounts using stolen Gmail accounts and using various and always changing IP addresses. This seems like a great plugin to stop this.

Thanks,

Jeff