We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 31088
    • 14 Posts
    curiouser and curiouser...

    Correction: I can’t save chunks with HTML in them.

    Mod_security doesn’t appear to be on my server. Any mention of it in my htaccess causes a 500 error.

    I can create and save a chunk which says "I think I’m going to blow chunks...urp...", but if I try to create or edit one which says:
    <div class="[[+cls]]">
        <a href="[[+url:default=`[[+image_absolute]]`]]">
            <img class="[[+imgCls]]" src="[[+thumbnail]]" alt="[[+name]]"/>
        </a>
        <small>[[+name]]</small>
    </div>
    for example... nothing. I get the "saving" notifier, but never the "saved!" one.

    sigh.


    Edit:
    OK, nested HTML tags are the threshold.
    for instance:
    <div>I am poorly formatted html.</div>

    works fine.
    <div><p>I am more semantically correct than the above example.</p></div>

    does not work.
    No error messages.

    This sounds in every way like a mod_security-’like’ issue, but since it appears not to be present...
    / edit

    Edit 2:
    This is the same with a brand-new un-spoiled install of 2.11.
    Just tried it.
    Same thing.

    What I really don’t understand is why 2.08 worked... does anyone know what specifically changed that would have an effect on posted data?
    / edit2
      • 22303 MODX Staff
      • 10,725 Posts
      The 500 error may be because you are not allowed to have those directives in your .htaccess file. You need to discuss with your hosting provider.
        • 31088
        • 14 Posts
        yeah could be.

        wish I knew why 2.08 worked. Then I could probably figure out what changed, and maybe fix it.
          • 31088
          • 14 Posts
          OK, that worked smiley

          Just for reference for anyone who finds this in a search:

          In my case, mod_security was running, but not visible or configurable from a user account. It could only be set by the administrator - my hosting company. A request to them to turn off sec filtering to domain.com/manager/index.php has worked like a charm. In some cases you may have to get them to turn filtering off for the domain itself.

          Everything is working now.

          Thanks to everyone who posted responses, particularly OpenGeek. I wouldn’t have thought of that last suggestion - I don’t know enough about mod_security, and thought that if it was running I would be able to see it. Cheers for that smiley