From b318eb7e33b5a571e1354f56d0f39185960efeee Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <serg.brester@sebres.de>
Date: Mon, 29 Apr 2019 10:45:37 +0200
Subject: [PATCH 1/2] closes gh-2408: prevent execution of action `abuseipdb`
 for restored tickets

---
 config/action.d/abuseipdb.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf
index c53ed489..dfc81665 100644
--- a/config/action.d/abuseipdb.conf
+++ b/config/action.d/abuseipdb.conf
@@ -47,6 +47,9 @@
 
 [Definition]
 
+# bypass action for restored tickets
+norestored = 1
+
 # Option:  actionstart
 # Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
 # Values:  CMD

From 23d2281e579ec71306b8c7e554983d7d71c0344e Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Thu, 2 May 2019 15:22:45 +0200
Subject: [PATCH 2/2] action.d/nginx-block-map.conf: small fix with better
 RE-rule for removal of ID (token/session) via sed (anchored now)

---
 config/action.d/nginx-block-map.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/action.d/nginx-block-map.conf b/config/action.d/nginx-block-map.conf
index 33c15f9c..0b6aa0ad 100644
--- a/config/action.d/nginx-block-map.conf
+++ b/config/action.d/nginx-block-map.conf
@@ -105,4 +105,4 @@ actioncheck =
 
 actionban = echo "\\\\<fid> 1;" >> '%(blck_lst_file)s'; %(blck_lst_reload)s
 
-actionunban = id=$(echo "<fid>" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/$id 1;/d" %(blck_lst_file)s; %(blck_lst_reload)s
+actionunban = id=$(echo "<fid>" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^\\\\$id 1;$/d" %(blck_lst_file)s; %(blck_lst_reload)s