Installed glfusion on my hosting space and everything works great with exception to when I try to save configuration changes in the admin section of glfusion. When submitting the changes I recieve a error due to the fact that part of the values being passed through to the server are php date formats. Below is a explanation of the problem.
The issue here is that the server is filtering the content of the forum looking for security threats (which is a good thing). Unfortunately, it is seeing the date format settings as potential ‘security hack attempts’. Basically, it thinks:
[PHP]%A, %B %d %Y @ %I:%M %p %Z[/PHP]
is an attempt to pass a nasty value to the server in hopes it will somehow open a security hole.
Server error log:
[Wed Jan 06 16:52:38 2010] [error] [client 98.222.173.247] ModSecurity:
Access denied with code 400 (phase 2). Pattern match
“\\%(?!$|\\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})” at ARGS:date. [id
“950107”] [msg “URL Encoding Abuse Attack Attempt”] [severity “WARNING”]
[hostname “indylv.com”] [uri “/admin/configuration.php”] [unique_id
“S0UGJkBH5fwAAHwN4ZQAAAAy”]
The real issue is that the string above is a perfectly valid PHP format string to control how dates are displayed. The only fix I can think of is either host needs to relax this rule or whitelist the URI /admin/configuration.php. Is either one of these possible or will it not be possible to use glfusion with jodo host.