CSS/Javascript issue

[timalsina]

When CSS/Javascript minifier enabled, http://domain.com/inner.php/minify/6e22fc9f6772737f33b9aa7cd32ddd26.css
throws following error:

ECURITY ALERT

Request dropped!
I think you are a bad boy.

Reference code: SEC-DEFB-0002
Sorry for the inconvenience.

Due to this the css and js are not rendering in the page. Disabling CSS/Javascript minifier loads the regular css and js files as expected. The above case applies to all security levels when minifier and minifier+GZip compression enabled for CSS or JS files.

[webgift]

This security message is displayed when your IP address have not set or it is an empty string. Have you tried to do the same process with another browser? I believe that something change your IP address. Maybe a browser's add-on or something else?

[datahell]

"SEC-DEFB-0002" means that you have already been banned by the Defender. Clear your ban and show us the first message you get.

[webgift]

I looked for "I think you are a bad boy" expression. 

[timalsina]

Followed the instructions provided, does not work.
Completely deleted Elxis and re-installed fresh copy. Tried both: repository in webroot and above webroot. Still the same error. Did further log checking and turns out apache throws 403 error while accessing /inner.php/minify/6e22fc9f6772737f33b9aa7cd32ddd26.css

What could be the problem?

[timalsina]

Further findings - it was Varnish cache causing 403 forbidden. The sysadmins @ cloudservers will get back to me once they have a working resolution. For the time being Varnish cache will be turned off for Elxis powered site.

[timalsina]

This issue has been resolved.

[seadhna]

Hi there,
this issue is occurring for some visitors to our website. Their IP Address is not on the Defender Ban list. I tried turning off all minify and compression of CSS and JS but this does not solve the problem. They do not get the error on iPad - only desktop. Please explain how to remove the link 'I think you are a bad boy' - this looks very unprofessional. Many thanks!

[datahell]

The message regarding the "bad boy" is been displayed when the IP address of the visitor is invalid or empty.
Elxis Defender tries to get the IP address with these $_SERVER super global variables: HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, REMOTE_ADDR
The validation is performed with the standard PHP filter_var function and the FILTER_VALIDATE_IP flag.

Requires testing with the user having the problem to tell you how to fix it.
Disable Elxis Defender if you can't solve the problem.

[seadhna]

Hi, does this make the website very vulnerable if Elxis Defender is switched off?
Can you tell me which file the 'bad boy' message is in, we would really like to change this wording as it looks bad to this company.

[webgift]

You could change that message if you edit the file defender.class.php under the folder: /includes/libraries/elxis/ at line: 82.

[seadhna]

Thanks! by the way - the people in this company that cannot access the site, they say they CAN access it if they go https instead of http ? Does this make any sense to you?

[seadhna]

the company is saying they don't get this error on any other sites, so why do they need to change anything regarding IP address just for this site? any advice on what to say to them?

[datahell]

Elxis is secure enough with Defender disabled. Defender is just an additional protection layer which blocks some requests before reaching the site. If you disable it these requests will reach the site but this does not mean that will harm it. Elxis has not known security problem. I didn't understood the last question you wrote.

[seadhna]

Ok, thanks. The last question was - they are getting this 'bad boy' message and their opinion is 'we can visit all other sites ok - why do we have to take any action for your site' but regarding your previous explanation I understand they should do something regarding their IP?