• From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Topic: Cannot do any action under only User:Profile Menu:Administration

Hi Folks,
This is a really strange thing....

The problem I am observing is when going to a User's Profile Menu under Administration, where you can either assign the user to a group, or delete or ban them... suddenly it is erroring out.

The error is (when you click save, delete or ban) 403 Forbidden, you don't have permission to access /profile.php on this server.
The server is providing no other relevant information in the error log, and in fact only shows a 404 File Not Found log entry with regard to not finding /forumdirectory/403.shtml (typical).
Interestingly the referrer seems to be showing the correct link, unless the slash in /profile.php is incorrect(?), but then I would think it would also be incorrect in my test server, but it all looks good here;
and all other actions execute correctly on the deployment site sfaict, like changing any other profile settings, adding/removing post/topics, etc.

Additional information:
1) The administrator has already added users today and assigned some of them to groups, so it must have been working earlier today and just suddenly changed??
2) This is now also taking place on another long-time installed forum on the same server, so it is also affecting any old users, i.e., I went to test on a userbase I know is sound and it is happening there too.
3) My test forums on my local windows-apache installation shows no functional problems, everything works as expected - same installation.
4) The online deployment is a linux/unix apache server.

If the problem is at the host server, then what could cause this?  What can I ask of my host support team other than to restart the server?
What do you think this might be?

Thanks,

Last edited by twohawks (2008-12-02 01:34:18)

TwoHawks
Love is the Function.
No Form is the Tool.
  • Smartys
  • Former FluxBB.org Developer
  • Offline
  • Registered: 2008-04-27
  • Posts: 2,095

Re: Cannot do any action under only User:Profile Menu:Administration

mod_security on your host

Smartys's Website

  • From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Re: Cannot do any action under only User:Profile Menu:Administration

Thank you, Smartys.  I am having my tech guys check it out for me as I have not log access to indicate what about that.

Here is an interesting tidbit, I wonder how this relates....
In the access logs, where ever the error occurs, it shows a "POST" including "action=foo"... action=foo appears to be the definitve marker. 

ec: "POST /profile.php?section=admin&id=35&action=foo HTTP/1.1" 404 -

Why/how is foo being used in profile.php here? (see around line 1507 in the form there)
Is this some sort of forbidden type of link?
<snip-edited>
Can I change this 'foo' in profile.php?

FOLLOWUP...
I tested changing foo to unknown and the problem went away.  I think this confirms mod_security in an indirect way, but well enough.

I am trying to figure out why action=foo is needed, if it can be something else, and what if it is removed entirely?

Last edited by twohawks (2008-12-02 11:44:53)

TwoHawks
Love is the Function.
No Form is the Tool.
  • Smartys
  • Former FluxBB.org Developer
  • Offline
  • Registered: 2008-04-27
  • Posts: 2,095

Re: Cannot do any action under only User:Profile Menu:Administration

It isn't needed. The problem is bad mod_security rules.

Smartys's Website

  • From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Re: Cannot do any action under only User:Profile Menu:Administration

Smartys wrote:

It isn't needed.

Then I am assuming I can remove it with no consequence, yes?
Why is the code in there if its not needed?

Smartys wrote:

The problem is bad mod_security rules.

Hmmm, I received the following reply from my server tech after requesting a copy from the relevant log (which I cannot access directly myself)...

The URI being passed to your script was triggering a mod security rule. I've added an exception for your domain and it should now be loading normally.

[Tue Dec 02 05:37:10 2008] [error] [client ipadderesshere ] ModSecurity: Access denied with code 403 (phase 2). Pattern match "profile\\.php\\?section=admin\\&id=.*\\&action=foo" at REQUEST_URI. [file "/opt/mod_security/98_asl_jitp.conf"] [line "598"] [id "310373"] [rev "1"] [msg "JITP: PunBB profile.php authentication bypass attempt"] [severity "CRITICAL"] [hostname "forum.example.com"] [uri "/profile.php"] [unique_id "STUd5kZV1wIAABd9nEIAAABH"]

With regard to the exception, I have read here about people turning off the mod_sec, but wouldn't it be a better thing to have it on and then tame it?

Last edited by twohawks (2008-12-02 19:05:20)

TwoHawks
Love is the Function.
No Form is the Tool.
  • Smartys
  • Former FluxBB.org Developer
  • Offline
  • Registered: 2008-04-27
  • Posts: 2,095

Re: Cannot do any action under only User:Profile Menu:Administration

I'm not sure why Rickard put the action=foo in there. Maybe to deal with some caching schemes that weren't working properly?
And the exception is the second best way to do it (the best way would be to get a decent set of mod_security rules: that set is out of date by over a year, I believe). tongue

Actually, I just found where your host got the rules from:
http://z.askapache.com/modsec/99_asl_jitp.conf
I'll send them an email about it later

Smartys's Website

  • From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Re: Cannot do any action under only User:Profile Menu:Administration

Thanks for your attention and reply's, Smartys ;^)

TwoHawks
Love is the Function.
No Form is the Tool.
  • Smartys
  • Former FluxBB.org Developer
  • Offline
  • Registered: 2008-04-27
  • Posts: 2,095

Re: Cannot do any action under only User:Profile Menu:Administration

And success!

310373 is now disabled.  For everyone using ASL to manage their rules
the update should occur in a few minutes when we pushed an update to the
rules servers.  If you want to pass on this to your users please do,
they are welcome to manually update the free rules on their boxes (if
thats what they are doing).

So, you or anyone else with this issue can have your host update the rules.

Smartys's Website

  • From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Re: Cannot do any action under only User:Profile Menu:Administration

Maybe to deal with some caching schemes that weren't working properly?

Hey Smartys (or anyone who may have ome insight)...
I tried to dig up some information with regard to the comment you made there, but I am as yet failing to turn anything up. 
Can you elaborate? 
Where might I find some information on this sort of thing?
Is it something I may need to be concerned about, and if maybe so, how would I investigate the potential ramification you intimate there?

Thanks. HTH

TwoHawks
Love is the Function.
No Form is the Tool.
  • Smartys
  • Former FluxBB.org Developer
  • Offline
  • Registered: 2008-04-27
  • Posts: 2,095

Re: Cannot do any action under only User:Profile Menu:Administration

Don't worry about it

Smartys's Website

  • From: Stateline, NV USA
  • Registered: 2008-05-11
  • Posts: 76

Re: Cannot do any action under only User:Profile Menu:Administration

Great - thanks ;^)

TwoHawks
Love is the Function.
No Form is the Tool.