mod_security: Warning. Pattern match ????

Client Joined: Oct 07, 2003 Posts: 735 Location: Ohio

I have been developing another module and could not get it to come up at all. It is very basic and is my first use of functions. I checked my error logs and saw alot of these coming from my IP address.

Quote:

[Sat Feb 18 17:46:01 2006] [error] [client xx.xxx.xxx.xxx] mod_security: Warning. Pattern match "([0-9a-zA-Z]+[-._+&])*[0-9a-zA-Z]+@([-0-9a-zA-Z]+[.])+[a-zA-Z]{2,6}" at POST_PAYLOAD [hostname "www.eto-league.com"] [uri "/admin.php"]

My case and link are correct. My admin/index.php will not come up at all.

I don't know where I went wrong with this one.

Code:

<?php





/************************************************************************


* ETO Campaign Mod


* By: Donovan [3rd ID] 


* http://www.eto-league-com


* Copyright © 2006 by ETO


* License: GNU/GPL


************************************************************************/


if ( !defined('ADMIN_FILE') )


{


   die ("Access Denied");


}


global $prefix, $db, $aid, $module_name, $admin_file;


$aid = substr("$aid", 0,25);


$row = $db->sql_fetchrow($db->sql_query("SELECT title, admins FROM ".$prefix."_modules WHERE title='Campaign'"));


$row2 = $db->sql_fetchrow($db->sql_query("SELECT name, radminsuper FROM ".$prefix."_authors WHERE aid='$aid'"));


$admins = explode(",", $row['admins']);


$auth_user = 0;


for ($i=0; $i < sizeof($admins); $i++) {


    if ($row2['name'] == "$admins[$i]" AND !empty($row['admins'])) {


        $auth_user = 1;   


    }


}





if ($row2['radminsuper'] == 1 || $auth_user == 1) {





/*********************************************************/


/* ETO Campaign Admin Functions                          */


/*********************************************************/





   function campaign() {


    global $prefix, $db, $language, $admin_file;


    include("header.php");


    GraphicAdmin();


   // title("" . _CAMPAIGNMANAGER . "");


    OpenTable();


    echo "<table border=\"0\" width=\"100%\"><tr>";


   echo "<center><b>" Under Construction "</b></center><br><br>";


    echo "</table>";


    CloseTable();


   echo "<br>";


    OpenTable();


    echo "<center><font class=\"option\"><b>" . _ACTIVECAMPAIGNS . "</b></font></center><br>"


   ."<table border=\"1\" width=\"100%\" align=\"center\"><tr>"


   ."<td bgcolor=\"$bgcolor2\" align=\"center\"><b>" . _ID . "</b></td>"


   ."<td bgcolor=\"$bgcolor2\" align=\"center\"><b>" . _CAMPAIGN . "</b></td></tr><tr>";


    $result = $db->sql_query("select cid, c_name from ".$prefix."_eto_campaigns order by cid");


    while ($row = $db->sql_fetchrow($result)) {


   $cid = $row['cid'];


   $c_name = $row['c_name'];   


   echo "<td align=\"center\">$cid</td>"


       ."<td align=\"center\">$c_name</td>"       


       ."<td align=\"center\">[ <a href=\"".$admin_file.".php?op=editcampaign&amp;cid=$cid\">" . _EDIT . "</a> | <a href=\"".$admin_file.".php?op=addcampaign\">" . _ADD . "</a> ]</td><tr>";


    }


    echo "</td></tr></table>";


    CloseTable();


   include("footer.php");


   }


   


   function editcampaign($cid) {


    global $prefix, $db, $language, $admin_file;


    include("header.php");


    GraphicAdmin();


    title("" . _EDITCAMPAIGN . "");


    OpenTable();


    echo "<table border=\"0\" width=\"100%\"><tr>";


   echo "<center><b>" Under Construction "</b></center><br><br>";


    echo "</table>";


    CloseTable();


   include("footer.php");


   }





   function addcampaign() {


    global $prefix, $db, $language, $admin_file;


    include("header.php");


    GraphicAdmin();


    title("" . _ADDCAMPAIGN . "");


    OpenTable();


    echo "<table border=\"0\" width=\"100%\"><tr>";


   echo "<center><b>" Under Construction "</b></center><br><br>";


    echo "</table>";


    CloseTable();


   include("footer.php");


   }   


   


   function addterritory() {


    global $prefix, $db, $language, $admin_file;


    include("header.php");


    GraphicAdmin();


    title("" . _ADDTERRITORY . "");


    OpenTable();


    echo "<table border=\"0\" width=\"100%\"><tr>";


   echo "<center><b>" Under Construction "</b></center><br><br>";


    echo "</table>";


    CloseTable();


   include("footer.php");


   }   





   function editterritory($tid) {


    global $prefix, $db, $language, $admin_file;


    include("header.php");


    GraphicAdmin();


    title("" . _EDITTERRITORY . "");


    OpenTable();


    echo "<table border=\"0\" width=\"100%\"><tr>";


   echo "<center><b>" Under Construction "</b></center><br><br>";


    echo "</table>";


    CloseTable();


   include("footer.php");


   }   





   switch ($op) {





    case "campaign":


    campaign();


    break;





    case "editcampaign":


    editcampaign($cid);


    break;





    case "editterritory":


    editterritory($tid);


    break;





   case "addcampaign":


    editcampaign($cid);


    break;





    case "addterritory":


    editterritory($tid);


    break;    


}





} else {


   include("header.php");


   GraphicAdmin();


   OpenTable();


   echo "<center><b>"._ERROR."</b><br><br>You do not have administration permission for module \"$module_name\"</center>";


   CloseTable();


   include("footer.php");


}


?>

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

You'll need to get with your host and have them explain why they are using that filter in mod_security.

Posted: Sun Apr 23, 2006 8:43 am

Donovan: you don't by any chance have Ipowerweb do you? Did you get a resolution to this? I've been noticing this in my logs for a couple of months now and I finally have a call into them today. The "first line" guy referred it to the second tier guy (who probably has two computer courses rather than one) and they said they'd get back to me. I'm just wondering if you had any results getting this relaxed on your server.

It would probably be a good exercise to get out the regular expression manual and figure out what that expression means but there are other things that take priority.

Posted: Sun Apr 23, 2006 9:01 am

He now hosts this site with me and to my knowledge he no longer has that issue Wink

Posted: Sun Apr 23, 2006 9:45 am

Which is how I found my resolution. Smile

Move all you sites to Raven and never have a problem again.

I have tried 5 different times to get problems answered by ipowerweb and each time they blamed Nuke.

I realized that you truly do get what you pay for.

Posted: Sun Apr 23, 2006 10:36 am

I'll be on Raven's host someday, probably next November or December. April thru October is the busy bicycling season up here in the Northeast and my site that supports cycling here is relatively busy too, so I'd prefer to do conversions in the off season. I'm thinking of doing it in conjunction with loading up RN 2.10 assuming that it's available then.

Ipowerweb can't really blame Nuke for a mod_security warning that takes place before the user ever gets to Nuke. They can try but it won't fly. However, they can stonewall me about changing what is probably a system wide setting and there's not much I can do about that.

Raven does provide Phpmyadmin on his paid sites?

Posted: Sun Apr 23, 2006 3:28 pm

fkelly wrote:

Raven does provide Phpmyadmin on his paid sites?

Full cPanel with Fantastico and nothing held back except SSH access RavensScripts