Show Posts - The Code Queryer

General Software Discussion / Which Of These Security Methods Should I Try ? Mod Security Or GeoIP Apache Way

« on: April 19, 2019, 10:37 AM »

Technical Gurus,

I need your brilliant experienced opinion.
You see, it's practically impossible to make my website abide by the new EU GDPR without annoying my websites visitors. Hence, have decided to block all EU visitors altogether. I asked my webhost regarding this issue and they pointed me to these links:

Mod Security:
https://forums.cpanel.net/threads/blocking-visitors-from-certain-countries.574681/

GeoIP:
https://grepitout.com/install-mod_geoip-cpanel-easyapache-4/ and https://www.tecmint.com/install-mod_geoip-for-apache-in-centos/

They suggested I take the "GeoIP apache module way".
Now, I'm not too technical. New in all this. I tried installing both the Mod Security and the GeoIP Apache Module but failed (even after following the steps in the articles) as I don't have much experience with Unix/Linux. Therefore, searched for someone to take care of it. Told him to install both Mod Security and GeoIP Apache Module but to do it without touching the .htaccess because the following article says it will go to thousands of lines of code if I do it using .htaccess.
https://www.sitepoint.com/how-to-block-entire-countries-from-accessing-website/

The technician had a look at the links I gave and said he will install the GeoIP module but not by following the steps mentioned in the following article and he has to do it using .htaccess.
https://www.tecmint.com/install-mod_geoip-for-apache-in-centos/
Says there would only be 28 lines of code to block 28 EU countries.
Also says, if he follows the steps mentioned on the above link (tecmint article) then things will get messed-up. His exact words are:

"You can't directly edit apache configuration as techmin article suggest, because you are running cPanel. settings must be "friendly" with cpanel, or they'll get lost and make mess.".

He says he will do it following the steps mentioned here:
https://www.paunovic.win/2018/06/15/instalacija-mod_geoip-modula-na-cpanel-whm-serveru
He says that is the proper way to do it on cPanel Server.
I asked my webhost about this and they have gone silent. Hence, approaching you folks for your expert opinions.
I have Vps with Root Access: SSH, Panel. I got CentOS OS, Whm and cPanel ($15 version).
I got my webhost to build 8 cPanel accounts for my 8 domains. 1 cPanel account per domain. I think they built them via Whm. (Still learning about Whm).
I told the technician, I want him to set things up on my Whm so any domains & cPanel accounts I add in the future (1 new cPanel account for 1 new domain) to my Vps should also block EU visitors. He said aslong as I have Root Access he will set things up following the steps in that article:
https://www.paunovic.win/2018/06/15/instalacija-mod_geoip-modula-na-cpanel-whm-serveru

You have now heard about my hardwares & softwares and what I need done. Block all EU visitors from my current 8 websites and from all future websites/domains hosted on this Vps. My questions are:

Q1. Must the GeoIP and the Mod Security be installed on my Whm for them to work on all my current and future websites/domains/cPanels hosted on this vps under this Whm ?

Q2. Which option is best for me ? Mod Security or GeoIP ? If I install both then that would not be a problem. Am I right ?

Q3. Is the technician correct when he says "You can't directly edit apache configuration as techmin article suggest, because you are running cPanel. settings must be "friendly" with cpanel, or they'll get lost and make mess."
He says the steps in following article is bad:
https://www.tecmint.com/install-mod_geoip-for-apache-in-centos
Is he correct ?
He further says: "I'll compile GeoIP module and GeoIP database on your server Apache and then you can easily block countries, and do not have to block IPs.". Is it better to do it this way over the techmint article way ?
Should I opt for his method instead (do things the .htaccess way) and
should I ignore the warning on the Site Point Forum article to not to things the .htaccess way ?

I am puzzled, confused and need your expert opinions and advice as I know you won't be giving biased advices.

Thank you for your interest in helping me out.

Whatever method you recommend, make sure it will be easy for me to easily add more countries in the banning list without needing to fiddle with messy code.

Developer's Corner / Re: File Upload With Php

« on: April 18, 2019, 10:16 AM »

As a general note: 'Doesn't work' is the most useless error description you can provide to anyone trying to solve your problem. Describe what you do, step by step, in clear and short terms, preferably with clear screenshots of the steps you take and the error message that is presented to you. That will make answering or troubleshooting much more easier for yourself and the troubleshooter.

If you fling your questions onto StackOverflow in the same way as you do here, it is very obvious why you have encountered the open question limit over there. Don't expect your questions to be answered soon there (or here). People don't have any idea of what you are doing, how your environment looks like or what tools you are using. Here's a secret, they don't ~~give a flying f..k~~ care, because they have much more useful things to do with their time.

So, mention what version of PHP you use. Mention what type of server (Windows/Linux). Mention which web server (Apache, NGINX, other) etc.

Another general note: Web servers, by default, are configured only to serve files to anyone who asks, not receive files and storing these. How sure are you that the web server you use is configured to allow for file uploads?

Last general note of this post: You are setting some values in your final error message. Why? Error messages are there to inform the user and preferably never contain forms of code. That is true for any type of messaging to inform the user.

In your case, I would seriously suggest to start using an IDE for PHP development. It is clear that you don't. IDEs help you out with code completion, syntax and the better IDEs even have tools that analyze the code you create in them and show (some of) the errors in your concept code.

NetBeans and Eclipse have IDEs for PHP development that are free to use. PHPStorm is not free. Besides that info, I have no experience with any of them, so you are on your own there.
-Shades (April 17, 2019, 10:07 PM)

Thanks man for the enlightenment. Though, I would have prefered it without any swearing.
Thanks for the IDE suggestions. I use NotePad++. Anyway, which one do you use and which one you found better out of the 2 you sugegsted and why that one better over the other one ? Now, I'm interviewing you! ;)

Developer's Corner / Re: File Upload

« on: April 17, 2019, 06:51 PM »

[Select]

<?php

//Required PHP Files.

include 'header_account.php'; //Required on all webpages of the Site.

?>

<?php

if (!$conn)

{

$error = mysqli_connect_error();

$errno = mysqli_connect_errno();

print "$errno: $error\n";

exit();

}

if($_SERVER["REQUEST_METHOD"] == "POST")

{

//Check whether the file was uploaded or not without any errors.

if(!isset($_FILES["id_verification_video_file"]) && $_FILES["id_verification_video_file"]["Error"] == 0)

{

$Errors = Array();

$Errors[] = "Error: " . $_FILES["id_verification_video_file"] ["ERROR"];

print_r($_FILES); ?><br><?php

print_r($_ERRORS);

exit();

}

else

{

//Feed Id Verification Video File Upload Directory path.

$directory_path = 'uploads/videos/id_verifications/';

//Make Directory under $user in 'uploads/videos/id_verifications' Folder.

$directory_path_and_user_dir = "uploads/videos/id_verifications/$user";

if(!is_dir($directory_path_and_user_dir)) //IS THIS LINE CORRECT ?

{

$db_user = 'followin_user';

$mode = 0755;

mkdir($directory_path_and_user_dir, $mode, TRUE); //IS THIS LINE CORRECT ?

}

//Grab Uploading File details.

$Errors = Array(); //SHOULD I KEEP THIS LINE OR NOT ?

$file_name = $_FILES["id_verification_video_file"]["name"];

$file_tmp = $_FILES["id_verification_video_file"]["tmp_name"];

$file_type = $_FILES["id_verification_video_file"]["type"];

$file_size = $_FILES["id_verification_video_file"]["size"];

$file_error = $_FILES['id_verification_video_file']['error'];

//Grab Uploading File Extension details.

$file_extension = pathinfo($file_name, PATHINFO_EXTENSION);

$directory_path_and_user_dir_and_user_file = "$directory_path_and_user_dir/$file_name";

//if(file_exists("$directory_path_and_user_dir_and_user_file")) //THIS LINE IS NOT GIVING THE ERROR THAT FILE HAS ALREADY BEEN UPLOADED. INSTEAD GIVES THE ECHO THAT IS 26 LINES BELOW HERE: "Your Video File \"$file_name\" has been uploaded successfully!"

if(file_exists($directory_path_and_user_dir_and_user_file)) ////THIS LINE IS NOT GIVING THE ERROR THAT FILE HAS ALREADY BEEN UPLOADED. INSTEAD SHOWING BLANK WHITE PAGE.

{

$Errors[] = "Error: You have already uploaded a video file to verify your ID!";

exit();

}

else

{

//Feed allowed File Extensions List.

$allowed_file_extensions = array("mp4" => "video/mp4");

//Feed allowed File Size.

$max_file_size_allowed_in_bytes = 1024*1024*100; //Allowed limit: 100MB.

$max_file_size_allowed_in_kilobytes = 1024*100;

$max_file_size_allowed_in_megabytes = 100;

$max_file_size_allowed = "$max_file_size_allowed_in_bytes";

//Verify File Extension.

if(!array_key_exists($file_extension, $allowed_file_extensions))

{

$Errors[] = "Error: Select a valid video file format. Select an Mp4 file.";

}

//Verify MIME Type of the File.

elseif(!in_array($file_type, $allowed_file_extensions))

{

$Errors[] = "Error: There was a problem uploading your file $file_name! Make sure your file is an MP4 video file. You may try again."; //IS THIS LINE CORRECT ?

}

//Verify File Size. Allowed Max Limit: 100MB.

elseif($file_size>$max_file_size_allowed)

{

$Errors[] = "Error: Your Video File Size is larger than the allowed limit of: $max_file_size_allowed_in_megabytes.";

}

if(!is_uploaded_file($file_tmp)) //SHOULD I CHECK WITH $file_name OR $file_tmp ?

//if(!is_uploaded_file($file_name)) //SHOULD I CHECK WITH $file_name OR $file_tmp ?

{

die("$file_tmp has failed to upload via HTTP POST!");

//die("$file_name has failed to upload via HTTP POST!");

}

else

{

echo "$file_tmp has been successfully uploaded via HTTP POST!";

//echo "$file_name has been successfully uploaded via HTTP POST!";

}

//Move uploaded File to newly created directory on the server.

if(!move_uploaded_file($file_tmp, "$directory_path_and_user_dir/$file_name")) //SHOULD I CHECK WITH $file_name OR $file_tmp ?

//if(!move_uploaded_file($file_name, "$directory_path_and_user_dir/$file_name")) //SHOULD I CHECK WITH $file_name OR $file_tmp ?

{

$db_user = 'root'; //IS THIS LINE NECESSARY ?

$mode = 0755; //IS THIS LINE NECESSARY ?

//Notify user their Id Verification Video File uploading failed.

echo "Your Video File \"$file_name\" has failed to be uploaded! You may try some other time.";

exit();

}

else

{

echo "Your Video File \"$file_name\" has been uploaded successfully!";

exit();

}

}

}

}

?>

<form METHOD="POST" ACTION="" enctype="multipart/form-data">

<fieldset>

<p align="left"><h3><?php $site_name ?> ID Video Verification Form</h3></p>

<div class="form-group">

<p align="left"<label>Video File: </label>

<input type="file" name="id_verification_video_file" id="id_verification_video_file" value="uploaded 'Id Verification Video File.'"></p>

</div>

</fieldset>

<p align="left"><button type="submit" class="btn btn-default" name="id_verification_video_file_submit">Submit!</button></p>

</form>

</body>

</html>

<?php

include 'footer_account.php'; //Required on all webpages of the Site.

?>

I need someone to tell me what is wrong with my code ? It does not upload video files.

Developer's Corner / Re: File Upload

« on: April 12, 2019, 01:12 PM »

Again, check StackOverflow with your questions. You'll have a larger variety of coders and people to help you. If someone knows here, they'd be happy to help you, but we have a smaller pool and depending on timeframe they might not be able to answer.
-wraith808 (April 11, 2019, 08:12 AM)

Having trouble at StackOverFlow as it says I reached my questioning limit.
How-about you give it ago to answer my questions ?

Developer's Corner / Re: Building Pagination With Php 7 Using Mysqli And Prepared Statements

« on: April 12, 2019, 01:11 PM »

Again, check StackOverflow with your questions. You'll have a larger variety of coders and people to help you. If someone knows here, they'd be happy to help you, but we have a smaller pool and depending on timeframe they might not be able to answer.
-wraith808 (April 11, 2019, 08:11 AM)

Having trouble at StackOverFlow as it says I reached my questioning limit.
How-about you give it ago to answer my questions ?

Messages - The Code Queryer [ switch to compact view ]

General Software Discussion / Which Of These Security Methods Should I Try ? Mod Security Or GeoIP Apache Way

Developer's Corner / Re: File Upload With Php

Developer's Corner / Re: File Upload

Developer's Corner / Re: File Upload

Developer's Corner / Re: Building Pagination With Php 7 Using Mysqli And Prepared Statements