From 8b016e3e53a89dcc3ae90c3fa181dcf5d10ec49b Mon Sep 17 00:00:00 2001 From: BertKoor Date: Thu, 28 May 2026 13:19:12 +0200 Subject: [PATCH] Fix: #5376 - bypass BAD_ROBOTS list of user agents with entry `allow_ua` in config.ini.php The list is comma separated, entries are trimmed for spaces but case sensitive, eg: ``` allow_ua="Baiduspider, SeznamBot, Uptime-Kuma, Yandex" ``` --- app/Http/Middleware/BadBotBlocker.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/Http/Middleware/BadBotBlocker.php b/app/Http/Middleware/BadBotBlocker.php index 8a275ad72f..6da2166743 100644 --- a/app/Http/Middleware/BadBotBlocker.php +++ b/app/Http/Middleware/BadBotBlocker.php @@ -1535,9 +1535,12 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface return $this->response('Not acceptable: no-ua'); } - foreach (self::BAD_ROBOTS as $robot) { - if (str_contains($ua, $robot)) { - return $this->response('Not acceptable: bad-ua'); + $allow_ua = Validator::attributes($request)->string('allow_ua', ''); + if (array_filter(explode(',', $allow_ua), static fn (string $x): bool => str_contains($ua, trim($x))) === []) { + foreach (self::BAD_ROBOTS as $robot) { + if (str_contains($ua, $robot)) { + return $this->response('Not acceptable: bad-ua'); + } } }