500 internal server error when trying to save page template

els · 2006-01-13 20:07:57

When I hit the Save button in Presentation > pages, I get a 500 Internal Server Error. I can save other things (articles, forms, style, sections) without a problem.

I upgraded to 4.0.3 a week ago, this is the first time since the upgrade that I try to save a page template.

The server error log is showing entries like this (I added line breaks for readability):
<notextile>
[Fri Jan 13 20:42:13 2006] [error] [client 84.31.187.76] mod_security: Access denied with code 500.
Pattern match “(((URL|SRC|HREF|LOWSRC)[\\s]*=)|(url[\\s]*[\\(]))[\\s]*[\\’\”]*[\\x09\\x0a\\x0b\\x0c\\x0d]*
j[\\x09\\x0a\\x0b\\x0c\\x0d]*a[\\x09\\x0a\\x0b\\x0c\\x0d]*v[\\x09\\x0a\\x0b\\x0c\\x0d]*
a[\\x09\\x0a\\x0b\\x0c\\x0d]*s[\\x09\\x0a\\x0b\\x0c\\x0d]*c[\\x09\\x0a\\x0b\\x0c\\x0d]*
r[\\x09\\x0a\\x0b\\x0c\\x0d]*i[\\x09\\x0a\\x0b\\x0c\\x0d]*p[\\x09\\x0a\\x0b\\x0c\\x0d]*
t[\\x09\\x0a\\x0b\\x0c\\x0d]*[\\:]” at POST_PAYLOAD [hostname “doggiez.nl”] [uri
“/textpattern/index.php”] [unique_id “qVzNCNlzylUAAEnHSr8AAAAX”]
</notextile>
Diagnostics:

Textpattern version: 4.0.3 (r1188)
last_update: 2006-01-05 21:04:57/2006-01-05 21:04:13
Document root: /home/httpd/vhosts/doggiez.nl/httpdocs
$path_to_site: /home/httpd/vhosts/doggiez.nl/httpdocs
Textpattern path: /home/httpd/vhosts/doggiez.nl/httpdocs/textpattern
Permanent link mode: section_title
open_basedir: .:/home/httpd/vhosts/doggiez.nl:/tmp:/usr/share/pear
upload_tmp_dir: /tmp
Temp folder: /home/httpd/vhosts/doggiez.nl/httpdocs/textpattern/tmp
Site URL: doggiez.nl
PHP version: 4.3.11
Server time: 2006-01-13 20:58:06
MySQL: 4.0.26
Locale: en_GB.UTF-8
Server: NOYB
Apache version: NOYB
PHP mode: apache2handler
Operating System: Linux 2.4.21-37.ELsmp

Pre-flight check:
————————————
Clean URLs are only supported for apache, use at your own risk
————————————

.htaccess file contents:
————————————
#DirectoryIndex index.php index.html
#Options +FollowSymLinks
#RewriteBase /relative/web/path/

<IfModule mod_rewrite.c> RewriteEngine On

RewriteCond %{HTTP_HOST} !^doggiez\.nl
RewriteRule (.*) http://doggiez.nl/$1 [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^(.+) – [PT,L] RewriteRule ^(.*) index.php </IfModule>

Redirect permanent /artikel http://doggiez.nl/artikelen
Redirect permanent /inhoud http://doggiez.nl/artikelen
Redirect permanent /rubriek/opvoeding-en-training http://doggiez.nl/rubriek/clickertraining
Redirect permanent /rubriek/opvoeding+en+training http://doggiez.nl/rubriek/clickertraining
Redirect permanent /rubriek/over+boeken http://doggiez.nl/rubriek/over-boeken
Redirect gone /images/roodkapje.jpg

order allow,deny
deny from 66.246.252.91
deny from 69.42.82.164
deny from 64.255.161.43
allow from all

php_value register_globals 0

————————————

Sencer · 2006-01-13 20:17:46

It doesn’t get any clearer than this:

[Fri Jan 13 20:42:13 2006] [error] [client 84.31.187.76] mod_security: Access denied with code 500.

It’s an apache module that pre-emptively tries to stop hacking attempts and sometimes spammers. Your case is a flase positive. Contact your hosting provider with this. (Not textpattern related.)

els · 2006-01-13 20:19:57

Will do. Thanks Sencer.

els · 2006-01-14 16:29:56

O.K. I got my answer from my host:

This has indeed to do with modsecurity. We are using this since last week for extra security of the servers. In this case a page wants to post something while there is javascript in the POST payload, or a url with a javascript. That is a known way to hack a site: post a piece of javascript in a forum or guestbook that opens the hacker’s site every time someone goes to the posting, this is not allowed by modsecurity.

I hope my translation makes sense, I certainly don’t understand much of it :(

Now I understand this is not Textpattern related, but what I don’t understand is why it only happens when I try to save a page template. And is there something that can be done about it to bypass this modsecurity thing?

zem · 2006-01-14 22:47:03

what I don’t understand is why it only happens when I try to save a page template.

Your template includes some text that triggers the filter, probably a <script> tag or javascript: link or something like that. Their filter is designed to block any web form submission that includes suspicious text, much like an email spam filter. Their definition of “suspicious”.

And is there something that can be done about it to bypass this modsecurity thing?

Ask your hosting company.

FWIW, this is all the FAQ.

els · 2006-01-15 01:13:54

O.K. thanks Alex, I had not found that FAQ because it says 412 instead of 500. I’ll try removing my javascripts then.

Edit: Well, it turned out to be caused by some stupid and not essential javascript to scroll to the top of the page:
<code>
<a href=“javascript:window.scrollTo(0,0);” title=“top”>↑</a>
</code>
Isn’t that strange?

Anyhow, I’m glad it’s solved :)

Last edited by doggiez (2006-01-15 01:26:46)

zem · 2006-01-15 01:27:42

I had not found that FAQ because it says 412 instead of 500

Most answers have more than one question. I put extra questions in the excerpt field so they show up in a search.

els · 2006-01-15 01:31:27

I searched for ‘500’. Should have tried better I suppose… ;)

Sencer · 2006-01-15 08:35:18

I hope my translation makes sense, I certainly don’t understand much of it :( Now I understand this is not Textpattern related, but what I don’t understand is why it only happens when I try to save a page template. And is there something that can be done about it to bypass this modsecurity thing?

Think of it like this: Certain Vans and Trucks are used to rob your house, therefore your landlord has decided to tun those vehicles around at the beginning of the street, before they can reach your house. So, if you want to use a that kind of Van/Truck yourself, you currently can’t. Your host has to adapt the rules or explain to you how you can adapt those rules with respect to your house yourself. Or at least make a clear statement that “No, never can such a Van or Truck pass this street to your house”. In the latter case it would be up to you to decide whether that kind of interference is tolerable for you or not.

els · 2006-01-15 11:38:42

Thank you Sencer, that is a very clear explanation :)
Anyhow I told my host that it was just that one small, innocent (I think) javascript that caused the error.

Textpattern CMS

Textpattern CMS support forum

#1 2006-01-13 20:07:57

500 internal server error when trying to save page template

#2 2006-01-13 20:17:46

Re: 500 internal server error when trying to save page template

#3 2006-01-13 20:19:57

Re: 500 internal server error when trying to save page template

#4 2006-01-14 16:29:56

Re: 500 internal server error when trying to save page template

#5 2006-01-14 22:47:03

Re: 500 internal server error when trying to save page template

#6 2006-01-15 01:13:54

Re: 500 internal server error when trying to save page template

#7 2006-01-15 01:27:42

Re: 500 internal server error when trying to save page template

#8 2006-01-15 01:31:27

Re: 500 internal server error when trying to save page template

#9 2006-01-15 08:35:18

Re: 500 internal server error when trying to save page template

#10 2006-01-15 11:38:42

Re: 500 internal server error when trying to save page template

Board footer