Login

Thomas Helzle · (This post was last modified: 2016-08-16, 01:51:06 by Thomas Helzle.)

Hey,
on my new website I see something strange happening:
When I try to edit some of the pages and hit the "Save Updates" button, I get the download-dialogue for the file "changedata.php" instead of the file being saved. It only happens on four of the ~60 pages so I'm a bit lost what to look for, since they look the same to me as all the others.
I switched on debug mode but don't see an error.
File permissions for the pages are the same as for the ones that work.
I searched the forum for changedata.php but came up empty.
The errorlog does not show anything related.
I use Windows 8.1 x64 and tried Vivaldi as well as Firefox, both show the same issue.
Health-Check is all green.
The pages uses the same template as all others.

Would anybody here have an idea what it could be related to?

I use i18n, the simple input tabs, customfields, dynpages and the theme and edit syntax highlighters as plugins.

Thank you very much!

***shawn_a*** · 2016-08-10, 21:54:31

Try another browser.
Try a basic install.
Sounds like a host problem bad mime or php settings

Thomas Helzle · 2016-08-10, 22:17:07

Sorry, not convinced. ;-)
Why would that lead to only 4 of 60 pages to be affected that all share the same template, CSS, scripts, plugins?
- It's the same in Vivaldi, Firefox and Internet Explorer.
- I installed it last night, so it's a fresh version.
- It's all on the same virtual host (Strato in Germany).
Any other ideas?

This is one of the pages that behaves like that: http://www.screendream.de/design/regenstein/

Cheers,

Tom

***shawn_a*** · 2016-08-10, 23:52:58

Your host is redirecting those pages because it is detecting xss injection probably.

Have you checked the contents of these downloads to see what they say ? Is it actual source code or just a 404 or something page ?

Have you disabled all plugins?
Have you checked error logs, gs and host ?

Either way , bad host config, probably a blind redirect instead of a 302 or 404.

I'd suspect MOD_SEC

Thomas Helzle · 2016-08-12, 05:42:43

(2016-08-10, 23:52:58)shawn_a Wrote: Your host is redirecting those pages because it is detecting xss injection probably.

Have you checked the contents of these downloads to see what they say ? Is it actual source code or just a 404 or something page ?

Have you disabled all plugins?
Have you checked error logs, gs and host ?

Either way , bad host config, probably a blind redirect instead of a 302 or 404.

I'd suspect MOD_SEC

I did everything I could think of today:
Checked all file permissions - looking good.
Disabled almost all plugins (the site is life already, would be hard to disable i18n etc.).
Updated the site to 3.3.11 to see if any file got corrupted - no dice.
No errors I can see, neither GS nor host.

But your question on the download was a good one:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html><head>
<title>200 OK</title>
</head><body>
<h1>OK</h1>
<p>The server is temporarily unable to service your
request due to maintenance downtime or capacity
problems. Please try again later.</p>
</body></html>

That's pretty silly since I can save most pages just fine but those I can't I can't change consistently, so it can't really be a server problem.

I'd really love to be able to edit the pages, since there are still typos and text errors and the CK editor somehow inserts tons of " " in the text which does funny things to linebreaks, so I have to edit everything in source mode...

The only way I currently have is editing my local files and re-upload those...

I honestly have too little knowledge about MOD_SEC to know what to look for with such specific files acting up and others not.

But thanks a lot anyway, I'll try to bite my way through...

Cheers,

Tom

***shawn_a*** · 2016-08-12, 05:59:02

It says right there thats its a server error.
We do not send those responses that IS YOUR SERVER

Thomas Helzle · 2016-08-12, 06:07:54

(2016-08-12, 05:59:02)shawn_a Wrote: It says right there thats its a server error.
We do not send those responses that IS YOUR SERVER

I'm sorry to have bothered you.

***shawn_a*** · 2016-08-12, 07:11:24

I have no idea why the server is sending a 200 like that I would ask my host or check host error logs.
Truly bizarre, can you identify anything special about the 4 pages that do not work?

Scripts tags ? Code snippets?

Mod sec is a apache filter that detects xss injections among other things.
Since you are posting of form and that forms contents are getting back sent back to you it thinks you've successfully injected code which is exactly what we want to do a CMS modify html code and have it come back.

Someone once mentioned having quotes in your content causes this, but it could be any pattern a security filter detects. Of course it could be something else entirely like a timeout or your server has locked files or who knows.

What is the server running?

***shawn_a*** · 2016-08-12, 07:19:02

I have posted some htaccess rules on the forum to disable mod sec sometimes it helps sometimes it dossnt sometimes your host dossnt allow disabling it. But if you see a rule in your error log you can ask that it be bypassed.

Thomas Helzle · 2016-08-12, 08:23:12

Thanks a lot Shawn, that is very helpful to better understand the issue.
- It's always a pair of pages (using i18n), so if the german one acts up, the english one is affected too.
- One of the pages has quotes, one doesn't, so that's probably not it.
- No specific scripts or snippets - one of them has a bandcamp iframe embedded but another page has too and that works.
- The error log doesn't show anything related to the GS installation. It's almost suspiciously empty - not sure if the hoster filters it somehow.

The server is running:
PHP Version 5.6.22 - OK
Apache Web Server Apache/2.2.31 (Unix) - OK
I can't really influence this much, since it's a host package, not my own server - I don't have direct access.

The .htaccess rules didn't work (https://github.com/GetSimpleCMS/GetSimpleCMS/issues/517)

I'll try to reach the host support tomorrow, at least I now understand better what to ask them ;-)

Thanks a ton!

Tom

***shawn_a*** · 2016-08-12, 09:07:52

Do you know how to code you can try that encoded on that issue.

Are your gs and host error logs empty?
Weird

Hmmmmm i would duplicate those pages.
And then systematically start removing content until it saves

Thomas Helzle · 2016-08-13, 21:37:49

No, I am not that much of a coder to know how to correctly implement this into GS, especially since you wrote there that it may not work in all cases.

Yeah, no errors shown in either log - weird.

I'm still not really sure what's happening.
Even if I delete all the content from one of those pages I can not save them (found a new pair, so it's six of them ATM), so I'm not even sure if it's content related. Still feels like some weird hickup in the system.
If I re-upload the page from my local system, in some cases I was able to save the page once, after that it's consistently back to the download instead of save.

I'll try to create new pages and add the content bit by bit to see if something in the existing pages has gone sour or where it breaks.

I didn't have the time yesterday to call the provider so will try that next week.
I only have a switch in my server config area to disable write access which is not active, no other settings that are related.
The other smaller GS site I have on the same webspace in a subfolder did not show the problem ever.

I'll report back if I find the problem.

Cheers,

Tom

***shawn_a*** · 2016-08-13, 23:27:36

This is version 3.3.10 ?

The new page idea is good.

Could your meta content or slug names be the cause ?
are you using any special characters in those

Thomas Helzle · 2016-08-16, 01:27:24

(2016-08-13, 23:27:36)shawn_a Wrote: This is version 3.3.10 ?

The new page idea is good.

Could your meta content or slug names be the cause ?
are you using any special characters in those

Problem solved!

Their support was not willing to help (running my own CMS, getting no error log...), but he mentioned a security setting to prevent guestbook-spam as unlikely to be the problem since only some of my pages were affected - which made me suspicious.
I never heard of that setting and started digging through the user interface and found it on a page that I had seen several times before but did not realise it had that setting on it (most security settings are somewhere else).
I deactivated it and all is working.

So your hunch was right, it was my server acting up and I guess they suppress errors from supposed spam - which did not help any in this case...
I can only set this for the whole hosted webspace and sadly the comment spam on my blog now started to come in, so I'll have to only disable it when I edit the pages.

In the long run, the encryption you mention on that issue thread could be a great feature for GS if it prevents such a filter to act, since security measures will only grow stronger over time.

I owe you a big thanks for bearing with me, even though it was not directly GS' fault.

Cheers,

Tom

Login
Username:
Password:	Lost Password?
	Remember me