Restrict access by bots
The EGOCMS offers protective measures against excessive access by bots (the so-called bot brake). These can greatly increase the server load and thus restrict the usability of the website for regular visitors or even make it impossible. In certain cases, the EGOCMS blocks access by bots and instructs them to try again later. EGOCMS version 26.2.0 provides decisive adjustments and enhancements to these measures.
Bot brake
- The default upper limit for the bot brake, which blocks access by bots if the server load is too high, is now 50%. The upper limit can still be set.
- All bot brakes triggered by the EGOCMS respond with a 429 Too Many Requests Status Code and a Retry-After 300 (5 minutes) header.
- The number of parallel bot accesses per second is limited to 30 (regardless of the IP). This value can be adjusted via "Administration > System > Security".
- This measure is only active if the upper server load limit has not already been reached. In addition, the PHP module APCu must be installed and activated.
- The EGOCMS image provides an activated rate limit in the Nginx settings, which allows a maximum of 5 page views per second from the same IP.
- The server load is now calculated via the top.sh script every 5 seconds. The shorter intervals help the bot brake to intervene in good time.
Features
- Front-end administration:
- If a favourite block was last inserted, the favourites group is automatically selected the next time a block is chosen.
- If the block toolbar is focused for a short time, all toolbars from any active editors within the block are hidden. This is to prevent the two toolbars from overlapping.
- The TinyMCE editors in blocks are now only initialised when they are focused (e.g. with the mouse or a drag-and-drop event). This speeds up the loading of the "Content" tab for pages with a large number of blocks and editors.
- Empty elements are an exception. These are always initialised immediately, as this is the only way the placeholder for the empty element becomes visible.
- System check:
- The log for the last run is written to var/log/systemcheck.log.
- The ffmpeg tool is checked during the system check and generates a warning if it is not installed. If it is not present, certain features cannot be used.
- QR Code:
- The Smarty function {qr} supports the parameters quietzone and colour (details).
- A page’s QR code tool can also change the border and colour of the QR code in the preview. These settings are also applied when downloading the QR code image.
- The selected colour is reused throughout the browser session.
- In the QR code tool, the permalink is always automatically preselected, as this is the recommended URL to use for a page as a QR code.
- Material Kit Design:
- In the design settings, you can enter IDs for Google Tag Manager and Meta Pixel. If at least one of these is used, cookie consent is required, and you can customise the text displayed for this.
- The "Contact Form" block automatically sets a CAPTCHA if the client and the page have no view restrictions.
- The default ‘Transfer’ permission can be set per client (by default, only superusers are permitted to do so). This always applies in addition to the ‘Transfer’ permission set for individual pages and cannot be removed for individual pages.
- REST API: The page permission check by view is only performed if ` auth_or 1=1 ` has not been explicitly passed.
- On the "Information" tab, the data for "created", "modified" and "published" is always updated immediately upon saving.
- The display of the media pool has been changed to a grid system.
- For the AD import, a regular expression can be set on the "Exchange%$ tab to identify usernames that must not be imported.
- In addition to the type_regex parameter, the type_regex_exclude parameter is now also supported (reverse check).
Compatibility
- In the "Text" form block, the "Datum" type no longer generates a warning that the element is not supported in all browsers. All modern and up-to-date browsers now support this element.
- The file system icons are now generated dynamically. The directory ` bin/admin_skin/egotec/img/icons/ ` has been removed. If you are still referencing icons from this directory, you can use dynamic file system icons instead.
- Other GIF-format icons have also been removed. If you are using such icons in custom page types, you will need to update the paths.
Performance
- The cron script for cleaning up the permissions tables for users who no longer exist has been optimised.
- The process of determining whether a request is from a bot or identifying the output device has been significantly speeded up.
Bug fixes
- Mediapool sorting is working again.
- When using the Collabora Editor for Mediapool files, the dialogue box was displayed incorrectly.
- WebDAV: Multimedia files are uniquely identified by their name and file type in the additional field, meaning that multiple files with the same name but different file types can exist at the same level.