modxcms / revolution

MODX Revolution - Content Management Framework
https://modx.com/
GNU General Public License v2.0
1.36k stars 529 forks source link

Unable to create a system setting #13724

Closed p-boiko closed 6 years ago

p-boiko commented 6 years ago

Summary

Unable to create a system setting. Happens on 2.6.0 and 2.6.1 in Firefox 59 and Chromium 63

Step to reproduce

Open System Settings page, click Create New Setting button, fill the fields and make sure to select Text field for the Field type and paste a full URI into the Value field. Hit Save. Or find a setting, containing a full URI, for instance feed_modx_news and try to update it. Just open it for updating and hit Save And a side effect (I assume the issues are related): searching for a setting, containing a full URI, or just a protocol with ://, for instance https:// fails too – it never ends.

Observed behavior

The setting is not being saved, javascript stops working until page reload. The following errors are reported to a browser's console: TypeError: this.mask.addClass is not a function and TypeError: this.mask.el is undefined

Expected behavior

New setting should be created

Environment

Lightspeed Firefox 59 and Chromium 63 MODX Revolution 2.6.1-pl (advanced), but observed also in 2.6.0 Version codename: Revolution ExtJS Version: 3.4.1 Smarty Version: 3.1.27 PHPMailer Version: 5.2.14 MagpieRSS Version: 0.72 Database type: mysql Database version: 10.0.31-MariaDB-cll-lve Database charset: utf8mb4

sottwell commented 6 years ago

I don't seem to be able to replicate this issue.

Revo 2.6.1 FF 57.0.1 (Mac)

OptimusCrime commented 6 years ago

Can you check your MODX error log and the PHP error log? I suspect there might be a problem with utf8mb4.

p-boiko commented 6 years ago

Thank you, @sottwell and @OptimusCrime The logs do not seem to contain relevant errors reports. MODx': public_html/core/model/modx/modcachemanager.class.php : 344) Error caching lexicon topic lexicon/en/core/default - it is the only error that is reported Can't find general php log file though. Will contact ISP. BTW, just to be clear, if I omit a protocol, the setting is being saved

p-boiko commented 6 years ago

The only PHP error reported is dated more then 2 weeks ago: `[01-Dec-2017 07:37:30 Europe/London] PHP Fatal error: Uncaught Error: Call to a member function get() on null in /home/zdwyyzos/public_html/core/model/modx/modrequest.class.php:184 Stack trace:

0 /home/.../public_html/core/model/modx/modrequest.class.php(115): modRequest->getResource('id', '1')

1 /home/.../public_html/core/model/modx/modx.class.php(1400): modRequest->handleRequest()

2 /home/.../public_html/index.php(57): modX->handleRequest()

3 {main}

thrown in /home/.../public_html/core/model/modx/modrequest.class.php on line 184 ` Sorry for the mess. The error is not related :)

p-boiko commented 6 years ago

Update: it's a LightSpeed server, not Apache. And I have a 403 error on request to ajax/index.php when error occurs

sottwell commented 6 years ago

This almost sounds like a server mod_security issue.

p-boiko commented 6 years ago

Today ran into the issue again - was unable to save changes in a snippet, which contains a URL :) As @sottwell suggested, there should be some security issue with my setup. But I don't consider the issue is closed. @Jako , don't you think it would polite from a MODx to notify a user about the error? It may save some time and mental health for a user. I'll figure out what is the problem, and, may be, will post here a report to help somebody. Meanwhile I modify the snippet (as well as I saved the System Setting) with a phpMyAdmin. Ugly workaround :)

Mark-H commented 6 years ago

Your hosting provider or server admin should have logs and the ability to tweak mod security settings to resolve it for you.

sottwell commented 6 years ago

As far as MODX reporting such errors, it can't. MODX never gets invoked in these cases. It's an AJAX request, and the server is dropping the whole thing as soon as it sees a form submission with the blocked content, URLs apparently in your case. So MODX never gets called into action, the browser is just left sitting not getting a response to its AJAX request, with no way of knowing why it didn't get a timely response. Basically, the AJAX process just times out. Sometimes the server will return a 404 or a 500 error, it just depends on how the server is configured.

p-boiko commented 6 years ago

the last update, in order not to distract you guys (and girls): I just think it's a bad practice to let an app to fail silently. When I pass some outer objects to my function I always do some checkups to avoid such fails: TypeError: this.mask.el is undefined or TypeError: this.mask.addClass is not a function. And if MODX sends ajax request it is its' obligation to notify me if the request fails. And if some function fails (like this AJAX request), it shouldn't crash the whole application. And in my case JS just stops to work.

Basically, the AJAX process just times out.

No, it's not the case. It returns a value that MODX fails to deal with.

Sometimes the server will return a 404 or a 500 error, it just depends on how the server is configured.

It just would be nice to see the error. I didn't know that my ctrl-s doesn't produce the result – saving the changes I just made. Only when I was investigating why things do not work as expected I noticed that changes were not saved and then I have found why. And it took so many so precious time :( . I'm talking about that initial error that I was filing the issue. May be due to my lack of experience and I'm only one to blame. But when MODX will be more verbose it will be more user friendly

Thank you all, especially @sottwell , who is very helpful, as always :)

mrhaw commented 6 years ago

We probably should highlight this reoccurring issue on Server Requirements: https://docs.modx.com/revolution/2.x/getting-started/server-requirements

It's hard to recognize mod_security being enabled in code https://stackoverflow.com/questions/3182500/detect-if-mod-security-is-installed-with-php#3182521

Some host will return a 406 error but every host and server is different. I see it as a huge waste to try test for this in the code.