Hi There,
For every domainname my webhosting needs to make a set of rules because ModX generates Cross-site Scripting (XSS) Attack errors. Happens when i'm saving templates, chuncks, TV etc. For every new domain they have to apply rules. With some new ModX releases again...
Example:
ModSecurity: Access denied with code 400 (phase 2). Pattern match "(?:\\bhttp\\/(?:0\\.9|1\\.[01])|<(?:html|meta)\\b)" at ARGS:content. [file "/etc/httpd/modsecurity.d/modsecurity_crs_40_generic_attacks.conf"] [line "229"] [id "950911"] [msg "HTTP Response Splitting Attack"] [data "<html"] [severity "ALERT"]
Gr,
Erwin
-
☆ A M B ☆
- 24,524 Posts
It's not a cross-site scripting attack. It's simply a false positive because of the hosting company's ModSecurity settings. MODx cannot be held responsible for how the hosting company configures their servers.
One solution to this is to include files instead of having all the code in the template, chunk, TV etc. If you're using Revo, with version 2.2 it's very easy to specify that it's a "static" element and specify the file to include.
If you're using Evo, use a snippet that includes the specified file. Something like this will do the job.
[[includeFile? &file=`path/to/file.php`]]
<?php
if(is_file($file)) {
include $file;
}
return;
Well static elements could do the trick and i would certainly look into it. For now i'm looking for the right reaction to give to my hosting. They say ModX has been programmed incorrectly. Can u be a little bit more specific about the ModSecurity? What kind of adjustment do they have to make?
-
☆ A M B ☆
- 3,112 Posts
@sottwell,
In Revo, including file should use return, or you'll get '1' on top of the page.
<?php
if(file_exists($file)) {
return include $file;
} else {
return;
}
Rico
Genius is one percent inspiration and ninety-nine percent perspiration.
Thomas A. Edison
MODx is great, but knowing how to use it well makes it perfect!
www.virtudraft.com
Security, security, security! |
Indonesian MODx Forum |
MODx Revo's cheatsheets |
MODx Evo's cheatsheets
Author of
Easy 2 Gallery 1.4.x,
PHPTidy,
spieFeed,
FileDownload R,
Upload To Users CMP,
Inherit Template TV,
LexRating,
ExerPlan,
Lingua,
virtuNewsletter,
Grid Class Key,
SmartTag,
prevNext
Maintainter/contributor of
Babel
Because it's hard to follow all topics on the forum, PING ME ON TWITTER
@_goldsky if you need my help.
@scotwell, can you give me some more details?
Can someone give me some more details about de ModSecurity configuration?
☆ A M B ☆