pento
commented
6 years ago Thank you for the detailed report, @SuperGeniusZeb!
As is mentioned in your logs, rule 300015 is a "generic SQL injection protection" rule, which is known to cause problems for WordPress (or any CMS, for that matter). The usual way to get modsec working with WordPress is to whitelist the handful of URLs that could trigger this (or similar) rules. Could you have a look in your modsec config files (probably found somewhere under /usr/local/apache/conf/) from something that resembles this?
<LocationMatch "/wp-admin/post.php">
SecRuleRemoveById 300013 300014 300015 300016 300017
</LocationMatch>There will likely be similar rules for other locations, I'm particularly interested in anything that applies to /wp-json URLs. As the requests worked in Gutenberg 2.3, but stopped in 2.4, that suggests there's a rule that whitelists based on some difference between the two: if we can figure that out, we can potentially tweak our requests to avoid triggering these modsec rules.
ZebulanStanphill
Issue Overview
Starting with Gutenberg 2.3 and still in 2.5, I have had an issue where I was unable to save / publish posts containing phrases that correspond to certain SQL commands, including:
(Note that these phrases have to be in lowercase to trigger the error.)
Trying to save a post containing any of these phrases will fail, giving the "Updating failed" notification. I'm using the latest version of WordPress (4.9.4) and I have tested this without any plugins installed and with the Twenty Seventeen theme, I've tested it with posts, pages, and custom post types, and I've tested it on both Firefox Nightly and Chromium. The error happens on all of them. This error does not occur with Gutenberg 2.2, and it does not occur with the Classic Editor.
When I check the JavaScript console on Chromium, I see this error:
This does not happen for everyone, but it happens consistently for me. I know it has something to do with the firewall on my server detecting the SQL phrases in the post content. My website is using HTTPS. My server host is Liquid Web. It has ConfigServer Security & Firewall enabled. Originally, after multiple subsequent tries to save a post containing one of the SQL phrases, my IP would be banned from the server. I had to whitelist it in the
csf.allowfile of the firewall in order to keep testing and narrow down the issue. I checked some of the logs, and here is what I found after trying to save a post containing the phrase "alter table":In
/usr/local/apache/logs/error_log:In
/usr/local/apache/logs/modsec_audit.log:Steps to Reproduce
Expected Behavior
The post should save properly and shouldn't give any HTTP status code 500 errors.
Current Behavior
Trying to save a post containing the previously listed SQL commands will fail, and the "Updating failed" notification will appear. An HTTP status code 500 error will occur.
Possible Solution
It definitely has something to do with the server firewall detecting SQL phrases in the post content and thinking that some kind of SQL injection attack is trying to be performed. Also, in one of the previously linked logs, I noticed
Expires: Wed, 11 Jan 1984 05:00:00 GMT... I would guess that expiration date is unintentional, since 1984 was a considerably long time ago; I am not sure if that has any relevance or not, but I thought I would point it out.Related Issues and/or PRs
5675
Pinging @pento, as requested.