Forum

Thread tagged as: Problem, Error, Runway

mod_security issue?

Hi,

My own IP is being blocked by my web host because of something which happens when I edit a collection. It seems like the process of attaching an image to an item in a collection is triggering an error with mod_security. Host has said that since it's shared hosting editing the security settings is not an option. Is there anything I can change within Perch to fix it?

The upload of the image itself seems to work fine. It's when I try to save changes on the collection item that I get the problem. I've had Perch (not runway) running on the same server without a problem.

Thanks.

ModSecurity: Access denied with code 403 (phase 2).

Match of "rx (/install/index\\\\.php|/admin/fetch_data_af\\\\.php\\\\?action=create_txt_file_from_af_table$|/admin/structure/feeds/edit|^/([a-z]+/)?wp-admin/(?:admin|options-general)\\\\.php\\\\?page=wpsc-settings)" against "REQUEST_URI" required. [file "/usr/local/apache/conf/modsec_rules/10_asl_rules.conf"] [line "370"] [id "340159"] [rev "36"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Generic SQL inline command protection (MM)"] [data "null,null,null,"] [severity "CRITICAL"]

 [uri "/perch/core/apps/content/collections/edit/"]
Mark Smith

Mark Smith 0 points

  • 5 years ago
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

Can you post your diagnostics?
Mark Smith

Mark Smith 0 points

5 years ago 
PERCH INFORMATION
Perch Runway: 2.8.18
Production mode: Production (100)
Installed apps: content (2.8.18), assets (2.8.18), categories (2.8.18), collection_2 (2.8.18)
DB driver: PDO
DB tables: perch2_backup_plans, perch2_backup_resources, perch2_backup_runs, perch2_categories,
perch2_category_counts, perch2_category_sets, perch2_collection_index, perch2_collection_items,
perch2_collection_revisions, perch2_collections, perch2_content_index, perch2_content_items,
perch2_content_regions, perch2_gallery_albums, perch2_gallery_image_versions, perch2_gallery_images,
perch2_navigation, perch2_navigation_pages, perch2_page_routes, perch2_page_templates,
perch2_pages, perch2_resource_log, perch2_resource_tags, perch2_resources, perch2_resources_to_tags,
perch2_settings, perch2_user_privileges, perch2_user_role_privileges, perch2_user_roles, perch2_users,
perch_contentItems, perch_gallery_albums, perch_gallery_image_versions, perch_gallery_images,
perch_settings, perch_users, preowned
Users: 4
App runtimes:
<?php
$apps_list = array(
'content',
);
Editor plug-ins: markitup
H1: a7e50c0110f7891cc42f622562e3c583
L1: 20952ac39dea59e05088346ddc2225c8
headerColour: #ffffff
content_singlePageEdit: 1
helpURL:
siteURL: /
hideBranding: 1
content_collapseList: 1
lang: en-gb
update_2.5.3: done
latest_version: 2.8.15
on_sale_version: 2.8.19
headerLinkColour: #000000
linkColour: #333333
editorMayDeleteRegions: 0
perch_gallery_update: 2.8.5
headerScheme: light
perch_gallery_bucket_mode: single
perch_gallery_bucket: default
dashboard: 0
hide_pwd_reset: 0
content_hideNonEditableRegions: 0
content_frontend_edit: 0
perch_gallery_basicUpload: 0
update_2.8.17: done
update_runway_2.8.18: done
PERCH_DEVELOPMENT: 10
PERCH_STAGING: 50
PERCH_PRODUCTION: 100
PERCH_DB_SERVER: localhost
PERCH_DB_PREFIX: perch2_
PERCH_TZ: UTC
PERCH_HTML5: 1
PERCH_RUNWAY: 1
PERCH_ERROR_MODE: DIE
PERCH_DATE_LONG: %d %B %Y
PERCH_DATE_SHORT: %d %b %Y
PERCH_TIME_SHORT: %H:%M
PERCH_TIME_LONG: %H:%M:%S
PERCH_DEBUG:
PERCH_PREVIEW_ARG: preview
PERCH_DEFAULT_DOC: index.php
PERCH_DEFAULT_EXT: .php
PERCH_PRODUCTION_MODE: 100
PERCH_RWD:
PERCH_HTML_ENTITIES:
PERCH_SSL:
PERCH_STRIPSLASHES:
PERCH_PROGRESSIVE_FLUSH: 1
PERCH_AUTH_PLUGIN:
PERCH_DB_CHARSET: utf8
PERCH_DB_PORT:
PERCH_DB_SOCKET:
PERCH_SESSION_TIMEOUT_MINS: 20
HOSTING SETTINGS
PHP: 5.4.42
Zend: 2.4.0
OS: Linux
SAPI: cgi-fcgi
Safe mode: not detected
MySQL client: mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $
MySQL server: 5.6.27
Extensions: Core, date, ereg, libxml, openssl, pcre, sqlite3, zlib, bcmath, bz2, calendar, ctype, curl, dom,
hash, fileinfo, filter, ftp, gd, gettext, SPL, iconv, session, json, mbstring, mcrypt, standard, mysqlnd, mysqli,
mysql, Phar, posix, pspell, Reflection, imap, SimpleXML, soap, sockets, exif, tidy, tokenizer, wddx, xml,
xmlreader, xmlrpc, xmlwriter, xsl, zip, cgi-fcgi, PDO, pdo_sqlite, pdo_mysql
GD: Yes
ImageMagick: No
PHP max upload size: 2M
PHP max form post size: 8M
PHP memory limit: 32M
Total max uploadable file size: 2M
Resource folder writeable: Yes
Session timeout: 24 minutes
Native JSON: Yes
Filter functions: Yes
Transliteration functions: No
GATEWAY_INTERFACE: CGI/1.1
HTTP_ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
HTTP_ACCEPT_ENCODING: gzip, deflate
HTTP_ACCEPT_LANGUAGE: en-us
HTTP_CONNECTION: keep-alive
HTTP_COOKIE: cmsa=1; PHPSESSID=39011ade849624e1c15bab0b2e22152d
HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/600.8.9 (KHTML, like
Gecko) Version/8.0.8 Safari/600.8.9
PATH: /bin:/usr/bin
QUERY_STRING: extended
REDIRECT_STATUS: 200
REMOTE_ADDR: 82.46.131.42
REMOTE_PORT: 51046
REQUEST_METHOD: GET
SERVER_ADDR: 89.145.89.120
SERVER_PORT: 80
SERVER_PROTOCOL: HTTP/1.1
SERVER_SOFTWARE: Apache
UNIQUE_ID: VnKBM1mRWXgAB6p1HkwAAAAK
REQUEST_TIME_FLOAT: 1450344755.95
REQUEST_TIME: 1450344755
argc: 1
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

Did you edit this? It looks like there's a lot missing.
Mark Smith

Mark Smith 0 points

5 years ago

I removed lines which identified the server, db user names that sort of thing, I didn't think I should post that on a public forum. Can I email it to you instead?
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

I think ultimately there's going to be little I'll be able to do to correct this. It's a false positive match for the security rule - so essentially a server configuration issue.