craighall29
Guppy
Installed glfusion on my hosting space and everything works great with exception to when I try to save configuration changes in the admin section of glfusion. When submitting the changes I recieve a error due to the fact that part of the values being passed through to the server are php date formats. Below is a explanation of the problem.
The issue here is that the server is filtering the content of the forum looking for security threats (which is a good thing). Unfortunately, it is seeing the date format settings as potential 'security hack attempts'. Basically, it thinks:
is an attempt to pass a nasty value to the server in hopes it will somehow open a security hole.
Server error log:
The real issue is that the string above is a perfectly valid PHP format string to control how dates are displayed. The only fix I can think of is either host needs to relax this rule or whitelist the URI /admin/configuration.php. Is either one of these possible or will it not be possible to use glfusion with jodo host.
The issue here is that the server is filtering the content of the forum looking for security threats (which is a good thing). Unfortunately, it is seeing the date format settings as potential 'security hack attempts'. Basically, it thinks:
PHP:
%A, %B %d %Y @ %I:%M %p %Z
is an attempt to pass a nasty value to the server in hopes it will somehow open a security hole.
Server error log:
[Wed Jan 06 16:52:38 2010] [error] [client 98.222.173.247] ModSecurity:
Access denied with code 400 (phase 2). Pattern match
"\\\\%(?!$|\\\\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" at ARGS:date. [id
"950107"] [msg "URL Encoding Abuse Attack Attempt"] [severity "WARNING"]
[hostname "indylv.com"] [uri "/admin/configuration.php"] [unique_id
"S0UGJkBH5fwAAHwN4ZQAAAAy"]
The real issue is that the string above is a perfectly valid PHP format string to control how dates are displayed. The only fix I can think of is either host needs to relax this rule or whitelist the URI /admin/configuration.php. Is either one of these possible or will it not be possible to use glfusion with jodo host.