Mystery glitch on certain terms when posting

attentive

Hi all, I'm part of a community that recently migrated from MyBB to Flarum, with very positive results.

However, we've noticed a strange problem where posting fails with a spurious "permissions" issue, seemingly when a small number of key phrases appears.

For instance, "Anyway" will work, "aside" will work, but "Anyway, aside from" will cause the issue to appear.

It's a weird problem and doesn't seem to appear here on the Flarum Community board. I'm guessing it could be due to an extension or something?

Has anyone seen this one?

Test post:

Editing test post:

Save fails:

clarkwinkelmann

attentive what are your mention/search user settings? Flarum might be attempting to search a user to mention. This can happen if the words follow a @ in a sentence.

Are you familiar with the browser network tab under development tools? Are you able to see which URL (probably an API request) is returning an error?

I have deleted my previous post.

attentive

(Most of) the request / response headers are screenshotted below. The response is a 403, consistent with the error message. However if I change the message fragment back to Test no such problem occurs.

Request details

clarkwinkelmann

attentive if you were connected to the forum in that window, you should logout to invalidate the remember cookie value that's visible in your screenshot, otherwise it could be used to gain access to your account.

It's probably caused by a third-party extension, but I'm curious what it might be. It doesn't look like something related to the mention extension, which would use GET requests, it's probably not the Drafts extension because the API requests don't look like that and we don't see the Draft icon in the screenshot.

You could also take a look at the "Payload" tab in the network console, it might give us some hint as to what data it's attempting to save on that post.

attentive

By observation, this issue is occurring for certain combinations of words. It's almost as if it's a "waffle detector"!

Test results:

"Anyway" will not trigger it by itself
"Aside from" won't trigger the issue either,
"Anyway, aside from" will trigger the 403
"Anyway, aside fr" won't trigger the 403
"I, aside fr" will trigger the 403
", aside from" will trigger the 403

and so on.

I wonder is it because of a bug in the Markdown renderer? I've just realised <aside> is an HTML tag … and of course from is a SQL reserved word, so perhaps some subsystem thinks the post is an injection attack or something?

luceos

One of the things that would help narrow it down is the output of php flarum info, so that we can see which extensions are in use.

attentive

Hi there—I'm not the forum admin, but I will ask. Greatly appreciate the responsiveness of this community, it's going beyond my expectations to have two people here immediately, feel a bit caught on the hop. 😄

attentive

Hello @luceos @clarkwinkelmann, I have just realised this is the same issue as @MikeBanim has cited here: I didn't realise Mike had previously brought it up. He provides the output of php flarum info there.

Excuse the lack of bug report discipline. Looks like we are back at the idea of triage with all configured non-Flarum extensions, unless the information given here leads to any other bright ideas.

https://discuss.flarum.org/d/32143-permission-on-quoting-aside-from

luceos

attentive the easiest way to test what extension this is, is to go into the database under settings find the key called extensions_enabled, copy its value to a chat/textpad. It's in JSON format so ["extension-name","extension-other"] etc. Now cut that in half, make sure it's valid JSON and update the value in the database. Run php flarum cache:clear test whether the issue exists, if it does it's in this half of the extensions. If not it's in the other half. Of the half you know the issue originates, remove half from the original value, store the modified value in the database again, test and repeat.. Usually you'll discover the extension that is causing all this within 3 to 4 attempts.

MikeBanim

luceos I've tried that and also disabled every extension in my Dev environment and clered the cache and I'm still getting the permission error.

clarkwinkelmann

MikeBanim you could try to reproduce with debug set to true in config.php and then copy the entire JSON response from the API in the network tab. I think that in debug mode we should get the exact location of the code that throws the error. In production mode there is no way to find out which extension is throwing a permission error except trial and error.

MikeBanim

clarkwinkelmann Ok, not quite sure what I'm looking for here, I see this:

errors

Payload is this:

{"data":{"type":"posts","attributes":{"content":"This is huge now. Aside from the obvious, if we beat Spurs tomorrow, they'll play City twice in quick succession needing to get some kind of results to stay in the hunt."},"relationships":{"discussion":{"data":{"type":"discussions","id":"4767"}}}}}

Debug in browser shows this:

POST https://onemoreinthetolly.com/flarum/public/api/posts

<!DOCTYPE html>
<html style="height:100%">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<title> 403 Forbidden
</title></head>
<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">
<div style="height:auto; min-height:100%; ">     <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">
        <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">403</h1>
<h2 style="margin-top:20px;font-size: 30px;">Forbidden
</h2>
<p>Access to this resource on the server is denied!</p>
</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;">
<br>Proudly powered by  <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>

clarkwinkelmann

MikeBanim this response payload doesn't look like it was generated by Flarum.

It might be some sort of web firewall module on your server rejecting the request based on its content, before it ever reaches PHP/Flarum.

MikeBanim

I've just done a completely fresh install of Flarum on a new DB and I'm getting the error on it too.

Xavier

MikeBanim if you're sure that there were no limitations set in the Flarum, I think what clarkwinkelmann was right, it's a possible issue.

MikeBanim

clarkwinkelmann It might be some sort of web firewall module on your server rejecting the request based on its content, before it ever reaches PHP/Flarum.

You were right. I got the below from the host (namecheap, in case anyone else ever encounters the same issue) and it seems to be resolved now (at least on all the previously problematic words I tried):

ModSecurity is an Apache module which works as a web application firewall.

It blocks known exploits and provides protection from a range of attacks against web applications. However, sometimes, ModSecurity may incorrectly determine that a certain request is malicious, while it is actually legitimate. In such a situation we can white-list triggered mod_security rule on the server, so that you can bypass the block.

We have found and whitelisted a few triggered rules on the server. You can test your website updating once again now.

Thanks a bunch for your help.

Wellwisher

On the fresh install of flarum that u mentioned also has the issue, what php version are you running?

Xavier

Wellwisher I checked the forum he gave, and the PHP version of his host is 7.2.34, but I do not think it's related to the PHP version. I think that if even a fresh install include the problem, it might be caused by something like a firewall. I still doubt if it's caused by an extension, but I checked the extensions of a default fresh install flarum (directly created by composer), and didn't find any extension related to it.

Wellwisher

Xavier might be worth just updating the php version on your test bench/ fresh install only to see if flarum behaves differently:

https://discuss.flarum.org/d/31968-staff-diary-v17-cycle/5

It's literally pressing a php version button in ur webhosting control pannel and adding one line of code via composer... can't hurt to try. Takes a min.

MikeBanim

I think you can mark this as fixed, thanks!