Saving a TXP form returns a HTTP/2 418 error

phiw13 · 2021-07-08 05:56:46

Seriously? “I’m a teapot”? Like this ?

Editing and saving one (simple) form of the type Misc. Tested with both Firefox and Safari. Dreamhost + PHP 8 + TXP 4.8.7

Server response:

Sorry, the form could not be submitted. Please try again later.

Console reports (Firefox):

XHR POST https://l-c-n.com/textpattern/index.php  [HTTP/2 418 I'm a teapot 2187ms]

Referrer Policy: strict-origin-when-cross-origin

Contents of the offending form:

Message received via the La Chatte Noire website
------------------------------------------------

Name: <txp:com_connect_value name="name" /> (<txp:com_connect_value name="email" />)

Message:
<txp:com_connect_value name="message" />

<txp:com_connect_if name="company">Company (会社名): <txp:com_connect_value name="company" /></txp:com_connect_if>
<txp:com_connect_if name="postcode">Postcode: <txp:com_connect_value name="postcode" /></txp:com_connect_if>
<txp:com_connect_if name="address1">Address:
<txp:com_connect_value name="address1" /></txp:com_connect_if>
<txp:com_connect_if name="address2"><txp:com_connect_value name="address2" /></txp:com_connect_if>
<txp:com_connect_if name="tel">Phone: <txp:com_connect_value name="tel" /></txp:com_connect_if>
<txp:com_connect_if name="fax">Fax: <txp:com_connect_value name="fax" /></txp:com_connect_if>
<txp:com_connect_if name="url">Website: <txp:com_connect_value name="url" /></txp:com_connect_if>
--------------
IP address: <txp:com_connect_value name="REMOTE_ADDR" />
Browser: <txp:com_connect_value name="HTTP_USER_AGENT" />

phiw13 · 2021-07-08 05:58:53

PS – Saving other forms works well.

I very rarely work directly in browser on live servers, I prefer the trusted code editor and then Theme > Update from Disk

Bloke · 2021-07-08 07:02:14

418 confirms that your hoster at least has a sense of humour.

In practice, I expect it just means that something in the form content tipped its anti-spam measures and instead of delivering a 403, they chose 418. I’d get in touch with them, send the offending form contents / HTTP request data and ask if there’s anything they can do to tweak the rules if it’s that causing a problem.

phiw13 · 2021-07-08 07:27:51

Yeah, I know what 418 is and that makes it flatly and deeply offensive — a stupidly bad graybeard-level attempt at “joking”. If the server responded with the correct error code, one would immediately know what is happening.

And yeah, I suppose I’ll have to plan to, again, contacting the support people.

Bloke · 2021-07-08 08:20:29

Developers are hilarious. Never a dull moment.

gaekwad · 2021-07-08 13:11:48

Error 418 on Dreamhost is most likely mod_security getting aggravated. As opposed to phiw13 getting aggravated. Last time I checked, and I don’t have enough brain capacity to venture too far down the rabbit hole given a rough night of sleep and a rougher morning of work, I think Dreamhost use OWASP rules as their reference: owasp.org/www-project-modsecurity-core-rule-set/

colak · 2021-07-08 18:05:11

After what Pete said, I’m wondering if you temporarily add


<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

would fix the problem and allow you to save the form.

phiw13 · 2021-07-09 01:05:58

gaekwad wrote #330939:

Error 418 on Dreamhost is most likely mod_security getting aggravated.

Yes, yes I understand this is mod_security at work and a (possibly) overzealous filter is triggered.

(BTW if you happen to be interested in the whole request/response chain for that particular event, let me know by PM, I have the whole thing saved).

colak wrote #330941:

(disabling mod_security temporarily)

I have not tried that, it might work, though – and I need to remember that .htaccess trick for the future. Thanks for the suggestion.

–≠–

Looking through the offending code, this is what trips the server filters:

Browser: <txp:com_connect_value name="HTTP_USER_AGENT" />

Removing that one line allows the normal saving process to go through. The snippet is included to have some more data to work with to filter out spammers (the offending form is the body of the email message for a contact form). But given that UA strings are more and more ‘neutered’, it is of not much use. I was thinking of dropping it anyway.

–≠–

Still offended by the use of error 418 - I am a teapot server response. If the server sends back one of the operation not permitted error codes, that would be so much nicer. Now it is just a poor taste joke (that, or the 418 status need to be standardised with a reasonable name).

colak · 2021-07-09 07:28:10

phiw13 wrote #330942:

Still offended by the use of error 418 - I am a teapot server response. If the server sends back one of the operation not permitted error codes, that would be so much nicer. Now it is just a poor taste joke (that, or the 418 status need to be standardised with a reasonable name).

It can indeed be interpreted as a derogatory, non politically correct term. The intentions though appear to be fine. I do agree with you, that they did not put much thought into it, and they obviously did not pass it through a proper ethical editing process.

gaekwad · 2021-07-09 08:40:10

phiw13 wrote #330942:

If the server sends back one of the operation not permitted error codes, that would be so much nicer.

I have to agree. Not exactly helpful for troubleshooting, especially when available time and/or patience may be at a premium.

phiw13 · 2021-07-09 08:53:48

- Yiannis (Colak) dito that. That status code might be something of fun in a controlled environment on April 1 or so. Beyond that, not much more than nothing.

- Pete (Gaekwad)

when available time and/or patience may be at a premium

Especially the latter!

Textpattern CMS

Textpattern CMS support forum

#1 2021-07-08 05:56:46