• Resolved WebsiteOpzetten

    (@websiteopzetten)


    My slimstat plugin is not recording any visitor activity anymore on two of my websites, since March 24th. It’s still working on all of my other websites. The websites that are effected are still receiving (a lot of) traffic, which can also be confirmed with Google Analytics.

    I’ve already tried deleting and reinstalling the plugin.

    When I go the the ‘Maintenance’ tab on Slimstat, it shows a tracker error:

    [date and time] 203 Attempted XSS Injection: android-app://com.google.android.googlequicksearchbox (IP: [IP address])

    Any help on getting the plugin to work again is much appreciated.

Viewing 13 replies - 1 through 13 (of 13 total)
  • Plugin Author Jason Crouse

    (@coolmann)

    Hi,

    can you please post the website URL, so that I can run some tests on my end?

    Best,
    Jason

    Thread Starter WebsiteOpzetten

    (@websiteopzetten)

    Hi Jason. You can run the tests on krachttraining.info.

    Plugin Author Jason Crouse

    (@coolmann)

    Hi,

    based on the tests we ran on your site, I am assuming you are using a spam blocking plugin called WP-SpamShield. Apparently a recent update they released is conflicting with Slimstat, and preventing the tracker from recording new page views. The error being reported by that plugin is:

    FOUT: Sorry, er is een fout opgetreden. Zorg er a.u.b. voor dat JavaScript ingeschakeld is en Cookies toegestaan worden in uw browser en probeer het opniew.

    Please contact them and see if there’s anything that can be done to prevent this issue. Keep us posted!

    Please consider writing a review for Slimstat as a token of appreciation for the support you received. It would be a nice way to say thank you and to let people know how much you value this plugin:

    https://www.ads-software.com/support/plugin/wp-slimstat/reviews/#new-post

    Best,
    Jason

    Thread Starter WebsiteOpzetten

    (@websiteopzetten)

    Thanks Jason. Disabled that plugin, and Slimstat is now working correctly.

    Hi there,

    Developer of WP-SpamShield here. If you’re having any issues, please submit a support request so we can look into it. You’ll want to check the Troubleshooting Guide and FAQs first, as most issues are resolved by checking these. It’s usually not necessary to deactivate the plugin.

    There have not been any reports of conflicts with these two plugins so far. However, if there are, we will find a solution. (Unfortunately there is no way for us to look into it if users don’t report issues to us.)

    – Scott

    Plugin Author Jason Crouse

    (@coolmann)

    Hi All,

    keep us posted, so that we can update our knowledge base with any information useful to address similar issues in the future.

    Best,
    Jason

    Hi Jason,

    We’ve identified the issue. We’re going to release a fix soon with a whitelist for Slimstat. One suggestion though for better compatibility in the future: Right now when Slimstat does an AJAX call, it doesn’t identify itself as an AJAX request by using the X-Requested-With: XMLHttpRequest header. You might want to check out this thread: https://stackoverflow.com/questions/1885847/jquery-no-x-requested-with-xmlhttprequest-in-ajax-request-header

    WP-SpamShield checks the admin-ajax.php requests so we can’t just check the DOING_AJAX constant in WordPress, as other non-AJAX POST requests can come in through that endpoint. Starting in the next release (later today likely), WPSS will ignore all requests coming in through admin-ajax.php (at least for the relevant test that is currently causing the block) that are identified as AJAX with the XMLHttpRequest header. We’ll also add the whitelisting for Slimstat, but if you change the params in the future, the XMLHttpRequest will help across the board (likely with other plugins as well that deal with security).

    Hope that helps! Also, we have a guide for other plugin developers, and you can contact us here as well: https://www.redsandmarketing.com/plugins/wp-spamshield/hooks/

    FYI, we like Slimstat very much, and have positively reviewed it a while back. ??

    Hope this helps. Feel free to contact us.

    – Scott

    Plugin Author Jason Crouse

    (@coolmann)

    This is great information, Scott! I will forward your message to the developer, so that we can add this feature to the next release.

    Thank you also for writing your thoughtful review last year!

    Best,
    Jason

    Hi Jason,

    No problem! ?? You guys are very welcome. Keep up the good work.

    – Scott

    Hi @websiteopzetten and @coolmann,

    Just wanted to give you both a heads up that we just released WP-SpamShield version 1.9.9.9.5 with the fix. Tested and confirmed working with Slimstat. ??

    Let us know if you have any further issues.

    – Scott

    Plugin Author Jason Crouse

    (@coolmann)

    Hi @redsand,

    thank you for the speedy turnaround! You guys rock. I’ll make sure to write a review for your plugin later this morning. As for the issue, the developer tells me that he’s adding a fix to our code as well, following your advice to send the HTTP headers to identify itself. The new version should be released, according to our bi-weekly release schedule, this coming Monday.

    Cheers,
    Jason

    Plugin Author Jason Crouse

    (@coolmann)

    Just to confirm, this is the code that we will add to the next version of the tracker, please let me know if that would be enough to address the problem

    request.open( "POST", SlimStatParams.ajaxurl, true );
    request.setRequestHeader( "Content-type", "application/x-www-form-urlencoded" );
    request.setRequestHeader( "X-Requested-With", "XMLHttpRequest" );
    request.send( slimstat_data_with_client_info );

    Please note also that most of our requests are sent using the new asynchronous Beacon feature. Would that also be a problem?

    Thanks,
    Jason

    • This reply was modified 7 years, 11 months ago by Jason Crouse.

    Hi Jason,

    No problem! We want things to work flawlessly, and we definitely don’t want to hinder the functionality of other good plugins. ??

    Offhand the code you posted looks on-track. The third line:

    
    request.setRequestHeader( "X-Requested-With", "XMLHttpRequest" );
    

    is the most important part. Everything else should be fine. I’d just recommend testing out the code by running some debug code in the admin-ajax.php when your code runs and output/log/vardump the request headers to make sure it’s been added properly. If it has the X-Requested-With: XMLHttpRequest header, you should be good to go.

    Thanks for the awesome review! You guys rock as well. ?? Keep up the good work.

    – Scott

Viewing 13 replies - 1 through 13 (of 13 total)
  • The topic ‘Slimstat stopped working on two of my websites’ is closed to new replies.