We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 14779
    • 256 Posts
    I read the post at the Joomla forum, and tried to implement it, but I got o 400 error when trying to view my home page.

    Here is what I added to the .htaccess:
    RewriteRule ^(.*)$ index.php [F,L]
      PM me to find out how you can get a FREE ipad 2!
      • 28042 ☆ A M B ☆
      • 24,524 Posts
      I was thinking more along the lines of something like this:
      ########## Begin - Rewrite rules to block out some common exploits
      #                              
      # Block out any script trying to set a mosConfig value through the URL
      RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
      # Block out any script trying to base64_encode crap to send via URL
      RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
      # Block out any script that includes a <script> tag in URL
      RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
      # Block out any script trying to set a PHP GLOBALS variable via URL
      RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
      # Block out any script trying to modify a _REQUEST variable via URL
      RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
      # Block out any script that tries to set CONFIG_EXT (com_extcal2 issue)
      RewriteCond %{QUERY_STRING} CONFIG_EXT(\[|\%20|\%5B).*= [NC,OR]
      # Block out any script that tries to set sbp or sb_authorname via URL (simpleboard)  
      RewriteCond %{QUERY_STRING} sbp(=|\%20|\%3D) [OR]
      RewriteCond %{QUERY_STRING} sb_authorname(=|\%20|\%3D)     
      # Send all blocked request to homepage with 403 Forbidden error!
      #RewriteRule ^(.*)$ index.php [F,L]
      # 
      ########## End - Rewrite rules to block out some common exploits
      

      only adapting this to MODx. Maybe somebody more conversant with .htaccess can take it from here?

      Really, all this will do is stop the 200 responses. A patched installation won’t let these attacks hurt anything, it just looks bad in the logs.
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 33372
        • 1,611 Posts
        Although setting register_globals to off would be a much more foolproof option, and there’s pretty much always a way to do that on any host...
          "Things are not what they appear to be; nor are they otherwise." - Buddha

          "Well, gee, Buddha - that wasn&#39;t very helpful..." - ZAP

          Useful MODx links: documentation | wiki | forum guidelines | bugs & requests | info you should include with your post | commercial support options
          • 33372
          • 1,611 Posts
          Quote from: ZAP at Nov 20, 2006, 08:06 PM

          If you get a 500 Server Error then you can’t add these directives there and you’ll need to use the php.ini method instead. In that case contact your host because not all of them allow for local php.ini files (and this method is somewhat more complicated than the .htaccess method because you need to set all PHP settings in this file - not just this one - or the rest revert to PHP defaults). It might be easiest in that case to ask your host to set that value for you in the master php.ini file for your account.

          You know I just had to set register_globals to Off on a GoDaddy site, and I used php.ini because they don’t allow php_flags to be set in .htaccess (or at least it didn’t work the way I’m used to doing it; I think that perhaps it might have worked inside a virtual directory). Anyway I used a php.ini file instead, and I only added register_globals off to it. Contrary to my comment above, this did NOT reset all of the other PHP values to their defaults, and I did not have to place php.ini files in all directories (it was effective recursively).

          So at least on this GoDaddy server, setting register_globals to off in a php.ini file was just as easy as via .htaccess.

          This just goes to show that there’s always a way to turn this setting off, and that you should use the view PHP info link in the MODx System Reports screen to verify that the settings are correct after making the change.
            "Things are not what they appear to be; nor are they otherwise." - Buddha

            "Well, gee, Buddha - that wasn&#39;t very helpful..." - ZAP

            Useful MODx links: documentation | wiki | forum guidelines | bugs & requests | info you should include with your post | commercial support options