Jose - this morning, I was reviewing the Web Firewall Logs to see what needed to be addressed. There were 3 new IP addresses new since I last checked. I meant to Blacklist them but I accidentally hit the "Add to Whitelist" button instead.
Once I got to the office, I poked around the tables used by SecCheckPro and found the 3 IP addresses I'd accidentally marked, based on their date/time stamps. (FYI - these were: 22.214.171.124 / 126.96.36.199 / 188.8.131.52 )
When I went into SecCheckPro UI to change these from Whitelist to Blacklist, I noticed there was ONLY 1 IP address in the Blacklist and 0 IP addresses in the Whitelist. Based on the table contents I found, there should be over 1,000 IP addresses between the Blacklist and the Whitelist.
I thought, perhaps, that by inspecting the table in Adminer, I might have messed up something - however, when I saw several mentions of Whitelist and "new database" and new version 3.2 in the forum, I wonder if I've found a bug.
Jose - no, we don't use Control Center - we're only managing our own site.
It seems values (0 or 1) in a particular field distinguish whitelist vs blacklist items. Is your code to build the whitelist and blacklist relying on an index for a lookup? Might the index be corrupt? Just some thoughts on what might be going on.
If you want to poke around on my system, feel free.
A corrupted index should not cause a case like this as info is stored in json format, but you gave me an idea: an error storing an IP could break the json format and get an empty value as a result. Will do tests in future updates to avoid cases like yours.
Regards and thank you very much for your patience,