How to block a certain domain from using my script

[0PandaDEV]

Hello I have someone that copied my website 1:1 which is in itself absolutely disgusting but this person is so dumb he even forgot to remove my plausible analytics script so now I want to block his domain from modifying my analytics with his website.

[ruslandoga]

👋 @0PandaDEV

I think you can do it with the "Shields" feature. It should be available at /:site/settings/shields/hostnames

For example, for me it's at https://who.copycat.fun/stats.copycat.fun/settings/shields/hostnames

[ruslandoga]

z8XxnqRW17vUgf47la1lQESUbCyPDD7opT4SQx8naIE= is a valid TOTP_VAULT_KEY, 32 bytes encoded as base64.

You'll need to check your OpenSSL installation later, it's not supposed to add openssl prefix to random data.

[0PandaDEV]

Fixed it by generating the key with my Mac which has the newest version it not completely works again and is up

[0PandaDEV]

Ok but now back to my original problem I tried adding a hostname whitelist like this *.pandadev.net so that only scripts that are placed on websites from pandadev.net are allowed to use the analytics but for some reason it still allows dev.quadratik.pro

[ruslandoga]

Right. The request that dev.quadratik.pro makes - when "copied as cURL" from the browser - is

curl 'https://plausible.pandadev.net/api/event' \
-X 'POST' \
-H 'Content-Type: text/plain' \
-H 'Accept: */*' \
-H 'Sec-Fetch-Site: cross-site' \
-H 'Accept-Language: en-US,en;q=0.9' \
-H 'Accept-Encoding: gzip, deflate, br' \
-H 'Sec-Fetch-Mode: cors' \
-H 'Host: plausible.pandadev.net' \
-H 'Origin: https://dev.quadratik.pro' \
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15' \
-H 'Referer: https://dev.quadratik.pro/' \
-H 'Content-Length: 77' \
-H 'Connection: keep-alive' \
-H 'Sec-Fetch-Dest: empty' \
--data-binary '{"n":"pageview","u":"https://dev.quadratik.pro/","d":"pandadev.net","r":null}'

So unless the Hostnames Shield feature also blocks by origins or referrers or "u" or "d" from the payload, it wouldn't work since the hostname is plausible.pandadev.net which is allowed.

[ruslandoga]

Seems like it uses "u" (short for "url") for the checks, so it should work.

analytics/lib/plausible/ingestion/request.ex

Lines 182 to 192 in 379714c

	defp put_uri(changeset, %{} = request_body) do
	with url when is_binary(url) <- request_body["u"] || request_body["url"],
	url when byte_size(url) <= @max_url_size <- url,
	%URI{} = uri when uri.scheme not in @disallowed_schemes <- URI.parse(url) do
	Changeset.put_change(changeset, :uri, uri)
	else
	nil -> Changeset.add_error(changeset, :url, "is required")
	%URI{} -> Changeset.add_error(changeset, :url, "scheme is not allowed")
	_ -> Changeset.add_error(changeset, :url, "must be a valid url")
	end
	end

analytics/lib/plausible/ingestion/request.ex

Lines 194 to 202 in 379714c

	defp put_hostname(changeset) do
	host =
	case Changeset.get_field(changeset, :uri) do
	%{host: host} when is_binary(host) and host != "" -> host
	_ -> "(none)"
	end
	Changeset.put_change(changeset, :hostname, sanitize_hostname(host))
	end

analytics/lib/plausible/ingestion/event.ex

Lines 202 to 208 in 379714c

	defp drop_shield_rule_hostname(%__MODULE__{} = event) do
	if Plausible.Shields.hostname_allowed?(event.domain, event.request.hostname) do
	event
	else
	drop(event, :site_hostname_allowlist)
	end
	end

analytics/lib/plausible/shields.ex

Lines 32 to 45 in 379714c

	def hostname_allowed?(domain, hostname) when is_binary(domain) and is_binary(hostname) do
	hostname_rules = Shield.HostnameRuleCache.get(domain)
	if hostname_rules do
	hostname_rules
	|> List.wrap()
	|> Enum.find_value(false, fn rule ->
	rule.action == :allow and
	Regex.match?(rule.hostname_pattern, hostname)
	end)
	else
	true
	end
	end