glfusion: PHP/security conflict

Installed glfusion on my hosting space and everything works great with exception to when I try to save configuration changes in the admin section of glfusion. When submitting the changes I recieve a error due to the fact that part of the values being passed through to the server are php date formats. Below is a explanation of the problem.

The issue here is that the server is filtering the content of the forum looking for security threats (which is a good thing). Unfortunately, it is seeing the date format settings as potential 'security hack attempts'. Basically, it thinks:

PHP:
%A, %B %d %Y @ %I:%M %p %Z

is an attempt to pass a nasty value to the server in hopes it will somehow open a security hole.

Server error log:
[Wed Jan 06 16:52:38 2010] [error] [client 98.222.173.247] ModSecurity:

Access denied with code 400 (phase 2). Pattern match

"\\\\%(?!$|\\\\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" at ARGS:date. [id

"950107"] [msg "URL Encoding Abuse Attack Attempt"] [severity "WARNING"]

[hostname "indylv.com"] [uri "/admin/configuration.php"] [unique_id

"S0UGJkBH5fwAAHwN4ZQAAAAy"]

The real issue is that the string above is a perfectly valid PHP format string to control how dates are displayed. The only fix I can think of is either host needs to relax this rule or whitelist the URI /admin/configuration.php. Is either one of these possible or will it not be possible to use glfusion with jodo host.
 
Back
Top