pages won't save when the word "from" is added

This is very odd behaviour! Basically, the scenario is as follows:

• Work on a document in the manager.
• Edit and save a few times.
• Add the word "from" somewhere in the doc.
• Doc won’t save and (unstyled) home page content is instead displayed within the right-hand pane of the manager.
• Once triggered, this can be replicated multiple times.
• Substituting "fro" or some other word that is not "from" will not trigger it. However, as soon as "from" is added back in, the same problem occurs.

I have a client experiencing this on his site and tonight it happened to me.

I suspect some sort of server error (as in an Apache error response of some sort) but I know next to nothing about Apache so don’t know where to start with trouble-shooting. The reason I suspect this is because I have MODx set to redirect to the home page (ID #1) on error or page not found etc.

Between the two of us, we have replicated this in Firefox 2 and IE6/7 and on multiple machines/ISPs.

Other info:

MODx: 095 rev 2106
OS: Linux
Apache: 1.3.37 (Unix)
PHP: 5.2.0
MySQL: 4.1.21-standard

Any ideas?

I suspect a badly configured mod_security on your host’s server. Things that might be mail injection (such as from, cc, or bcc) are blocked in POST uploads. Since you are filling out a form when you edit a document, and it gets sent to the server via POST, it won’t let it go through.

OK, thanks Susan; sounds plausible. I forgot to mention that I had just moved from a reseller hosting facility at one host to a VPS (Virtuozzo + WHM/cPanel) facility with a new host. So yes, there are very likely some config issues still to be resolved. I have root access, so I should be able to make any changes required if they are simple. Otherwise I can submit a support ticket. Any pointers as to what changes I need to make and to which file?

Anton

I’ve confirmed this problem is indeed caused by mod_security rules, as it does not occur when I add "SecFilterEngine Off" to "/manager/.htaccess" in my own site. However, I suspect that is not an ideal fix.

I had a look in the mod_security.conf file and it appears that there are tons of directives in there designed to prevent exploits for lots of different scripts.

Any suggestions as to what changes are required to maintain security while ensuring that the MODx manager functions normally would be gratefully received.

Thanks,
Anton

Quote from: AntonL at Jan 12, 2007, 08:34 PM

I’ve confirmed this problem is indeed caused by mod_security rules, as it does not occur when I add "SecFilterEngine Off" to "/manager/.htaccess" in my own site. However, I suspect that is not an ideal fix.
...

Any suggestions as to what changes are required to maintain security while ensuring that the MODx manager functions normally would be gratefully received.

Actually, the two options really are turning off SecFilterEngine as you have in the manager/.htaccess, or not allowing PHP code in snippets at all beyond including an external PHP file containing the snippet code. In the latter case, you would avoid the issue altogether, as PHP code would not be passing over the POST, which is part of what mod_security is designed to prevent.

Thanks for the input. I’m just confused by the reference to PHP in snippets as this problem is not happening with snippets (ATM), rather it is simply a normal web page document being saved in the manager.

Is it possible to set an exclusion that allows the word "from" in POST data, for the /manager/index.php file?

Alternatively, would I be better off with a trimmed-down mod_security rule set? I’m not sure I really need all the rules that are designed for scripts that I don’t actually use on my server. There are 5500+ lines worth of them in my mod_security.conf file!

Anton

This problem is usually only encountered when trying to save snippets. I’ve never heard of a mod_security configuration that is so touchy it won’t even save document content. But then I don’t know all that much about it, after all.

That makes two of us, then!

I’ve isolated the problem to this line in the mod_security.conf file:

SecFilterSelective ARGS "(insert[[:space:]]+into.+values|select.+from|bulk[[:space:]]+insert|union.+select)"

Is there a way to exclude this from filtering only the /manager/index.php file?

I believe that there is a way to override a general setting for a specific page; it seems to have something to do with

SecFilterSelective REQUEST_FILENAME - /var/www/htdocs/manager/index.php

and setting the filter for that file, but this is not something I am at all familiar with.

I’ve dug a bit more and discovered that there are actually 3 lines of interest here:



I think that the first filter tries to match various file paths and it is only if the pattern is not matched that the second (problematic) filter is applied. From this, it would appear that if I simply add "/manager/index\.php|" to the start of the pattern, it should prevent the filter being applied to the MODx manager.

I’m a little hesitant to experiment with this until someone with more experience in these matters can confirm that I am on the right track.