Bug?

[Wraith]

I was trying to post a reply to a thread, but kept getting an error message.
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@colonyofgamers.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 Server at www.colonyofgamers.com Port 80
I wrote a shorter reply and it submitted ok. I don't see anything particularly bad about the text that would cause the error. I'd post it here, but it keeps giving me the same error...

[fitbabits]

I was trying to post a reply to a thread, but kept getting an error message.

I wrote a shorter reply and it submitted ok. I don't see anything particularly bad about the text that would cause the error. I'd post it here, but it keeps giving me the same error...

It could be a character limit thing, but it would need to be over 15000 to trigger that error (including quotes, etc.). Was it that long?

[Wraith]

It's not even close to that. Text editor says it's 253 characters...

I'll screenshot it, as it doesn't seem to let me submit it in any way, shape, or form...

[Wraith]

Even trying to go from quick reply to advanced view gave me the same error message.

http://img.photobucket.com/albums/v298/wraithakamrak/cog_bug01.png

[fitbabits]

Huh! And you're able to post an abbreviated version of the same post?

[Wraith]

Huh! And you're able to post an abbreviated version of the same post?Basically I just started over. Didn't post that second paragraph at all.

Trying to post the fully reply here, I tried taking out the "&", apostrophes, punctuation, dollar signs, figuring it was some weird php bug or something, but no luck. Same message every time.

[Wraith]

It's something to do with the first sentence in the second paragraph.

I can post that sentence by itself fine. I can post the rest of the text without the sentence fine. I try to post first and second sentence of that paragraph, it gives the same error as trying to post the complete text.

Actually, if I take out the word "selector", it posts fine.
But it also posts fine if it's just that sentence, "selector" included.

Weird...

And THIS posted fine in the edit, with the word selector there.

[DangerousDaze]

I can reproduce this with just the following "s e l e c t o r f r o m" (with the spaces removed so it's just two words).

[Wraith]

Ohhhhh it's a sql injection blocker? Awesome. :D

[DangerousDaze]

Ah! Of course! I should have spotted that. Pfft.

/edit - Actually I really can't believe I didn't spot that. I use SQL all the damn time :/

/edit2 - You can get an idea of how much trial and error it took to narrow that right down!

[Wraith]

Ah! Of course! I should have spotted that. Pfft.

/edit - Actually I really can't believe I didn't spot that. I use SQL all the damn time :/

/edit2 - You can get an idea of how much trial and error it took to narrow that right down!Yeah, I'd only gotten it down to "selector", but seeing "s e l e c t o r f r o m" just made it easy to recognize.

[Wraith]

i n s e r t i n t o v a l u e s

and

d e l e t e f r o m

are blocked too.

[DangerousDaze]

d r o p t a b l e

the list goes on ;)

Reminds me of
http://imgs.xkcd.com/comics/exploits_of_a_mom.png

[bapenguin]

Wow good catch. That's pretty awesome too.

[DangerousDaze]

Wow good catch. That's pretty awesome too.

Can't resist a challenge. ;)

[DangerousDaze]

Any chance you could fix this problem? It's just that when it happens it's totally destructive as there's no way to navigate back and recover the (usually long!) post you were working on.

Thanks!

[Wraith]

Any chance you could fix this problem? It's just that when it happens it's totally destructive as there's no way to navigate back and recover the (usually long!) post you were working on.

Thanks!I've found that going back and hitting CTRL+Z (while in the textbox) to undo will bring back the text of your post, more often than not. (Though I still don't trust it with long replies, and I try to remember to do a copy first.)

[DangerousDaze]

Thanks, I'll give that a try next time.

Once you've lost faith that your post will even preview without just disappearing into something that fell out of the Large Hadron Collider (well, not yet anyway!) you start to get nervous about posting anything. I lost a ton of C coding help I did on another thread because I didn't expect any problems.

[bapenguin]

I looked through the settings and don't see anything. It might be hard coded.

[DangerousDaze]

It looks like an Apache thing. Take a look in:

/usr/local/apache/conf/modsec2.user.conf

You'll probably find pattern matching rules like (obviously without the dashes which I had to put in or this wouldn't post!):

"(i-nsert[[pace:]]+i-nto.+v-alues|s-elect.*f-rom.+[a-z|A-Z|0-9]|s-elect.+f-rom|bulk[[pace:]]+i-nsert|u-nion.+s-elect|c-onvert.+\\(.*from)"

You can either remove those rules or whitelist your VB site entirely.

[bapenguin]

It looks like an Apache thing. Take a look in:

/usr/local/apache/conf/modsec2.user.conf

You'll probably find pattern matching rules like (obviously without the dashes which I had to put in or this wouldn't post!):

"(i-nsert[[pace:]]+i-nto.+v-alues|s-elect.*f-rom.+[a-z|A-Z|0-9]|s-elect.+f-rom|bulk[[pace:]]+i-nsert|u-nion.+s-elect|c-onvert.+\\(.*from)"

You can either remove those rules or whitelist your VB site entirely.

Well wouldn't that be bad? I see the rule and it's pretty broad. I think the problem is because of the AJAX version of the post. I don't want to open the board up to that possibility of an attack.

[DangerousDaze]

The VB you're running is already hardened against SQL injection attacks so you really don't need your webserver coming in at a lower level and stomping all over it.

Check out this response (http://www.vbulletin.org/forum/showthread.php?t=182365) from a vB support guy on this very issue.

[rinichanraar]

Wow, I kind of didn't understand perfectly what everything in this thread meant, but what I did get was really awesome and kind of funny.

[J3DI]

This is the error I'm getting when I try to post to the CoG Tag ARG thread.

Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@colonyofgamers.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.


--------------------------------------------------------------------------------

Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7a mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.6 Server at www.colonyofgamers.com Port 80

[bapenguin]

Tried to fix this...as you may have seen. Unsuccessful.

Blah.

[DangerousDaze]

Server glitch we couldn't get around. Something with the world "UPDATE"

My solution - UMLAUT-IFY it.
Just saw this on the PS3/PSP firmware thread. I don't think you can dodge this problem for much longer because it's having a material impact on your site. Just comment out those rules as described earlier - it doesn't reduce your security but it does allow you to use words like U P D A T E. ;)

[hideouslywrinkled]

Sorry to thread jack, but I don't have a choice, because I can't post new threads. I keep getting an error message. Do I have to hit a preset number of posts before I can create threads? (I tried searching for a thread about it... but couldn't find anything.)

Here is my error message:

hideouslywrinkled, you do not have permission to access this page. This could be due to one of several reasons:

1. Your user account may not have sufficient privileges to access this page. Are you trying to edit someone else's post, access administrative features or some other privileged system?
2. If you are trying to post, the administrator may have disabled your account, or it may be awaiting activation.

[DangerousDaze]

Which forum are you trying to start your thread in?

[hideouslywrinkled]

I tried in this one and in the console games forum.

[bapenguin]

Just saw this on the PS3/PSP firmware thread. I don't think you can dodge this problem for much longer because it's having a material impact on your site. Just comment out those rules as described earlier - it doesn't reduce your security but it does allow you to use words like U P D A T E. ;)

Btw - I completely removed this plug-in. If it's still doing it, there's something else causing it.

[Mishima]

This is a useless post to get my count to 25.