I cannot write "fopen(); " to mysql on my clients webserver

2,204 Posts

Dimmy Reply #1, 17 years, 11 months ago

I have a strange problem

I made a import module that uses fopen(); when php or mysql sees this i getthis error in the iframe:

Forbidden
You don't have permission to access /manager/index.php on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

even if I use phpmyadmin and place this in any field of any table the same thing happents with this error:

Forbidden
You don't have permission to access /phpMyAdmin/tbl_replace.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

file is not saved

any one encountered this same problem?

I can save any other text but only when it sees fopen(some,parameter,here); or even fopen(); the I get the above errors.

Dimmy

follow me on twitter: @dimmy01

1,336 Posts

shamblett Reply #2, 17 years, 11 months ago

fopen() is conditioned by the following two settings, safe_mode and open_basedir.

The latter limits what you can fopen() to a specific directory tree on the server, I’d check these settings out on your server.

Use MODx, or the cat gets it!

2,204 Posts

Dimmy Reply #3, 17 years, 11 months ago

I see that modsecurity also blocks this

I did not even use fopen I only place this in a text even in a document I could never say: hello the folloing command is not alowed: fopen();
this wil already block the system

And I see in modsecurity this lines:


#Generic PHP exploit signatures
SecFilterSelective THE_REQUEST "(chr|fwrite|fopen|system|e?chr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:330001,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

#Generic PHP exploit signatures
SecFilterSelective POST_PAYLOAD|REQUEST_URI "<\?php (chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:330002,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

#slightly tighter rules with narrower focus
SecFilterSelective REQUEST_URI|POST_PAYLOAD "(chr|fwrite|fopen|system|echr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\(.*\)\;" "id:300008,rev:1,severity:2,msg:'Generic PHP exploit pattern denied'"

so I believe that that is the problem aahh
and its not my server but a shared server.

is there a way to open a file in another way?

follow me on twitter: @dimmy01

1,336 Posts

shamblett Reply #4, 17 years, 11 months ago

You can use file() or file_get_contents() if you want the whole file read in to an array or a string, depends what you want to do.

Use MODx, or the cat gets it!

☆ A M B ☆
24,524 Posts

sottwell Reply #5, 17 years, 11 months ago

You can also use the php curl library, if it’s enabled in your php.

You can also sometimes use the .htaccess file to customize the mod_security settings for your site (at least for the /manager/ folder)

Studying MODX in the desert - http://sottwell.com
Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
Join the Slack Community - http://modx.org

2,204 Posts

Dimmy Reply #6, 17 years, 11 months ago

Thanks for the pointers

I added this :

SecFilterEngine Off
SecFilterScanPOST Off

to the .htaccess file and now I can do the import.
after I imported the addresses i switched it on again.

Dimmy

follow me on twitter: @dimmy01