[Template] Andreas01 package

I have similar problems with the andreas01 snippet and mod_security on apache.

I could have given this a try locally, but as I happen to have access to my hosting provider’s machines (just happen to have a job there)
I took the opportunity to have a closer look and see what happens when altering things.

After some bad things happening lately mod_security was installed with rulesets from www.gotroot.com.

Some rules already had been taken out to avoid problems with phpMyAdmin but some were still left.

The first error I encountered (ip address and host name have been changed):

[Fri May 5 20:55:42 2006] [error] [client 192.168.1.1] mod_security: Access denied with code 403. Pattern match "(insert[[:space:]]+into.+values|select.+from|bulk[[:space:]]+insert|union.+select)" at POST_PAYLOAD [id "300016"][rev "1"] [msg "Generic SQL injection protection"] [severity "2"] [hostname "www.mydomain.com"] [uri "/manager/index.php?a=24"] [unique_id "RFufrVEEULQAAVkRifU"]

After taking out this rule, I hit a second rule:

[Fri May 5 21:04:41 2006] [error] [client 192.168.1.1] mod_security: Access denied with code 500. Pattern match "(((URL|SRC|HREF|LOWSRC)[\\\\s]*=)|(url[\\\\s]*[\\\\(]))[\\\\s]*[\\\\’\\"]*[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*j[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*a[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*v[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*a[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*s[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*c[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*r[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*i[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*p[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*t[\\\\x09\\\\x0a\\\\x0b\\\\x0c\\\\x0d]*[\\\\:]" at POST_PAYLOAD [hostname "www.mydomain.com"] [uri "/manager/index.php?a=24"] [unique_id "RFuhyFEEULQAAWMfGRU"]

This got me puzzled , and I tried another snippet and see what happened there:

[Fri May 5 21:51:14 2006] [error] [client 192.168.1.1] mod_security: Access denied with code 403. Pattern match "(chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\\\\(.*\\\\)\\\\;" at POST_PAYLOAD [id "300008"][rev "1"] [msg "Generic PHP exploit pattern denied"] [severity "2"] [hostname "www.mydomain.com"] [uri "/manager/index.php?a=24"] [unique_id "RFusslEEULQAAXsXpz0"]

This was the point where the bell started ringing
It isn’t the actual MODx code that is causing the problems, it is the payload that is hurting.
Maybe the payload should be encoded at the browser, then decoded at the server (I know a bit about programming, can read and modify PHP, and after some reading maybe even JavaScript, but e.g. can JavaScript uuencode, then send, and PHP uudecode then install snippet?)
Technically it would be safer, too.

With bad things happening over and over again, more hosting providers will turn to mod_security (or similar) and sending plain PHP, as in snippets will cause more and more problems.

Regards,

Marb

Quote from: Trance at Mar 20, 2006, 04:02 PM

Like to share the PM, and to get the result I was after:

Quote from: sottwell at Mar 20, 2006, 02:59 PM

Ah, I think I see what you mean...you want the submenus hidden until you are on that page, then you want the submenu for that page to show in a way that lets you know where you are. Try this in your css file:

#sideMenu li ul{
display:none;
}
#sideMenu li.here ul{
display:block;
}
#sideMenu li.here ul a{
color:#3f729f;

Adjust colors, backgrounds, etc to your liking.

Hope it all helps.. Thanks sooo much!!

This works fine for the first level, could anyone help me to get this work with the sublevels?

Greetings Markus

happy new year ...


Sorry, have been afk for a while and just saw the Q.

No, at the time I worked with the template the lower levels of the engine didn’t get the right look and feel. I had a hard time to get that part going. I abonden the template due to the trouble I had.

I changed template of the project to Still Waters (http://modxcms.com/Still-Waters-Template-1032.html) and changed the navigation and some other heavy stuff. It worked out fairly well. Still, heavy problems with IE5 / 6 / 7 and FF. They are all so different it is hard to get a consistent looking product off the shelves.

If you still hung up using this template for more depth, I would use a 2-tier system for your navigation. Hope this make sense..