We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 12983
    • 108 Posts
    MODx worked pretty well with our site hosted on a payed provider.
    Some days ago, something around their upgrade to Apache 2.2.x with mod_suphp module activated, the BAD!
    I don’t know if it’s related to that upgrade, btw suddenly it has ceased to work as always:
    whenever we write/update some content in whatever MODx field in manager (pages, chuncks, snippets, etc.) when we click on SAVE this is the message we get:


    Internal Server Error
    The server encountered an internal error or misconfiguration and was unable to complete your request.

    Please contact the server administrator, *********@**********.** and inform them of the time the error occurred, and anything you might have done that may have caused the error.

    More information about this error may be available in the server error log.

    Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

    This does not happen for every text we try to save, but we’ve found a couple of them that trigger the error:

    href="javascript:

    or:
    href=javascript:


    These "special" strings can also be contained in a bigger text: when they are there, here it comes the very bad error.

    What’s up, we’re in production and clients are pushing us from every side...
      • 12983
      • 108 Posts
      Here it is the log that our hosting provider has sent to us after our request, it seems that mod_security causes the error:


      ==4465b77f==============================
      Request: www.***********.** 151.53.11.121 - - [01/Apr/2008:17:55:46 +0200] "POST /manager/index.php HTTP/1.1" 500 662 "htt$
      ----------------------------------------
      POST /manager/index.php HTTP/1.1
      Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
      Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
      Accept-Encoding: gzip,deflate
      Accept-Language: en-us,en;q=0.5
      Connection: keep-alive
      Content-Length: 11039
      Content-Type: application/x-www-form-urlencoded
      Cookie: 4f8da52e876c15aeb73886b889fe91fc=7499; 1c66ba4e81ed5a51bb53b68570ea4c17=4051; SN47877a54b4ab6=caaed94a67df6841e49a0c1$
      Host: www.***********.**
      Keep-Alive: 300
      Referer: http://www.***********.**/manager/index.php?id=25&a=78
      User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
      mod_security-action: 500
      mod_security-message: Access denied with code 500. Pattern match "(((URL|SRC|HREF|LOWSRC)[\\s]*=)|(url[\\s]*[\\(]))[\\s]*[\\’$

      11039
      $rare+this+site+more+frequently+during+the+next+weeks.%3Cbr+%2F%3E%0D%0A++++++++++++%3Ca+href%3D%22javascript%3Ah$

      HTTP/1.1 500 Internal Server Error
      Connection: close
      Transfer-Encoding: chunked
      Content-Type: text/html; charset=iso-8859-1
      --4465b77f--


      What should we do? huh
        • Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 7231
          • 4,205 Posts
          I agree with Sottwell, this looks like a mod-security issue.
            [font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

            Something is happening here, but you don't know what it is.
            Do you, Mr. Jones? - [bob dylan]
            • 12983
            • 108 Posts
            Thanks.
            I’d like to use the suggestion to add the following into .htaccess:

            SecFilterEngine On
            SecFilterSelective "REQUEST_URI" "/manager/index.php" "allow,nolog"
            


            Which is the right .htaccess where I should add this one?
            The one in public_html, the one in MODx root, the one in manager, or everyone of them?

            I suppose the one in MODx root, btw I’m asking because after a quick try it seems to not solve the problem...
              • 12983
              • 108 Posts
              Also tried including from filesystem as suggested on that wiki page, but I get this error:


              « MODx Parse Error »MODx encountered the following error while attempting to parse the requested resource:
              « PHP Parse Error »

              PHP error debug
              Error: include() [function.include]: Failed opening ’’ for inclusion (include_path=’.;\xampp\php\pear\’)
              Error type/ Nr.: Warning - 2
              File: C:\path\to\modx\manager\includes\document.parser.class.inc.php(769) : eval()’d code
              Line: 12

              Parser timing
              MySQL: 0.0075 s (3 Requests)
              PHP: 0.0720 s
              Total: 0.0796 s

              As written there, I’ve created the file "resource.php" on filesystem, with this path:

              path\to\modx\stuff\resource.php

              Then I’ve created the snippet "IncludeFile":

              <?php
              
              //Check that the file is given.
              if (!isset($file) || $file == "") {
               return 'No file specified.'; 
              }
              
              //Start the buffer
              ob_start();
              
              //Include file contents
              include $phpfile;
              
              //Get contents from the buffer
              $ob_contents = ob_get_contents();
              
              //Kill/delete the buffer
              ob_end_clean();
              
              //Return contents to MODx
              return $ob_contents;
              
              ?>
              


              ...and called that as:

              [[IncludeFile? &file=`stuff/resource.php`]]
              


              This generates the error as above.


              By the way, I’ve changed the snippet IncludeFile with the following:

              <?php
              if(!isset($filename)) return;
              $filepath = "stuff/";
              $filetype = ".php";
              $scriptfilename = $filepath.$filename.$filetype;
              if(!file_exists($scriptfilename)){
                return ("<strong>Error:</strong> PHP script file ".$scriptfilename." not found");
              }
              include($scriptfilename);
              ?>
              


              ..called by:

              [!IncludeFile?filename=`resource`!] 
              


              ...and this works.

              Three questions:


              • Why the code on the wiki gives me that error?
              • Can I use the code I’ve written here without problems, or the one on the wiki is better?
              • Does MODx manages cache correctly if I use this method? That is, whenever I change the content of resource.php, do I have to clean the cache or it’s not necessary?
                • 12983
                • 108 Posts
                Just tried again with the suggestion on the wiki.
                The ".htaccess" file is in the root dir of MODx, i.e. where we can see also the "manager" and "assets" dir.
                I’ve addedd the rules on the top of the file.

                I confirm that:

                SecFilterEngine On
                SecFilterSelective "REQUEST_URI" "/manager/index.php" "allow,nolog"
                


                ...doesn’t work for me.

                Then I’ve tried:

                SecFilterEngine On
                SecFilterSelective "POST_PAYLOAD" "href=javascript:" "allow,nolog"
                


                ...but trying to save


                href=javascript:

                ...still triggers the Internal Server Error.

                So I’ve tried with:

                SecFilterScanPOST Off
                


                ...and this one works!
                And also:

                SecFilterEngine Off
                


                ...works!

                I know the last one is very unsafe, so I’d like to know if the first one of the two working rules is something safe to use.