Tripawds Three Legged Dog & Cat Forum Archives

benny55 said
...really hpoi g this is working now!

Us too! Whatever that means.

(You were clearly able to post those two comments...please advise if issues persist.)

benny55 said
...I have a screen shot of what I wrote.

Let me guess...

forum-userform_addpost=43856c129c&action=post&forumid=17&forumslug=beyond-cancer&topicid=11766&topicslug=bringing-home-a-tripawd-tomorrow&captcha=1428328254&postitem=YAY%21++SURGERY+IS+COMPLETE%21%21%21+++GREAT+NEWS%21%21%3Cimg+src%3D%22http%3A%2F%2Ftripawds.com%2Fwp-content%2Fsp-resources%2Fforum-smileys%2Fsmiley_clap.gif%22+title%3D%22clap%22+alt%3D%22clap%22+%2F%3E+%0D%0A%0D%0ASounds+like+you+are+setting+things+up+really+well+for+a+good+homecoming.++When+I+picked+my+Happy+Hannah+up+%28amputation+due+to+osteosarcoma%29%2C+I+didn%27t+even+look+at+her+incision+siteI++I+just+looked+straight+into+her+druggy+happy+eyes+and+told+her+what+a+good+girl+she+was+and+tole+her+I+had+lots+of+cookies+for+her+in+the+car%21++She+wagged+and+wagged+and+took+her+chunky+three+legs+straight+to+the+car+for+her+treats%21%21%0D%0A%0D%0AMikey%27s+avatar+picture+is+just+precious%21++And+I+bet+Maltese+is+just+as+cute.++Well....I+have+ro+say+though%2C+a+tripawd+gets+a+few+extra+bonus+points+in+the+cuteness+department%21%0D%0A%0D%0ATry+and+get+some+good+rest+tonight%2C++you%27ve+had+a+rough+24+hrs.++Mikey+is+seeing+pink+elephants+and++feeling+no+pain%21%0D%0A%0D%0ALooking++forward+to+tomorrow%27s+homecoming%21%0D%0A%0D%0AHugs+to+ya%27%21%0D%0A%0D%0ASally+and+Alumni+Happy+Hannah+and+Merry+Myrtle+too%21

Now, to determine why content like that is throwing false positives for mod_sec rule 211650...whatever that does. Too many smilies maybe!

Thank you for the link, that helped! But in reviewing logs like this we've discovered it will be much more helpful to have the IP address of the user at the time the error is noticed.

Codie Rae said
...I have had an error free day and evening on both tripawds.com and .org!

Thanks! We needed that around here today.

benny55 said
Holy Cow! What the bleep!

That's nothin'. The real problem lies in pattern matching misinterpreting certain forum posts as an SQL injection threat...

Pattern match "(?i:\\b(?i:x{0,1}or)\\b[\\t\
\
]{1,}('[^=]{1,10}'|[0-9]{1,10})[\\t\
\
]{0,}?[<=>]|\\bor\\b {0,1}(?:[\"'][^=]{1,10}[\"']|[0-9]{1,10}) {0,1}[<=>]{1,}|\\b(?i:x{0,1}or)\\b[\\t\
\
]{1,}('[^=]{1,10}'|[0-9]{1,10})|(?i:'[\\t\
\
]{1,}x{0,1}or[\\t\
..." at ARGS:postitem. [file "/usr/local/apache/conf/modsec_vendor_configs/comodo_apache/23_SQL_SQLi.conf"] [line "21"] [id "211570"] [msg "COMODO WAF: SQL Injection Attack"] [data "Matched Data: or 2 found within ARGS:postitem: <p>Thank you so much for your kind words, we cant tell you how much they mean to us...

FYI to All: Withouy getting to technical, we've made a few more tweaks, so please advise if problems persist!

If the "Access Forbidden" error is encountered, please provide:

1. Error encountered
2. Full URL to forum topic
3. Your IP address
4. Device and browser used
5. Content of post (if possible)

Sorry for the inconvenience. In the mean time, I suggest copying the content of any forum post before clicking Submit, in case saving it fails.You will need to reload the page, not just hit "Back", to try again.

Please note that repeated attempts to submit a post that fails may get you temporarily blocked by the firewall!

We will get to the bottom of this, thank you for your patience.

EDIT: Attempt to post this resulted in false positive for XSS Attack. If this saves, that has now been addressed.