-
Posts
14 -
Joined
-
Last visited
Community Answers
-
Kay Lohn's post in Session redirect problem was marked as the answer
UPDATE:
Fortunately, found out the reason.
The module 'MaintenanceMode' was the culprit. The pages worked as expected once the module was uninstalled.
To double check I re-installed the module again and same problem reappeared. On further investigation the redirect in 'MaintenanceMode' module was set to the 'blocked' page which caused the problem which when changed to some other page, the 'blocked' pages started to redirect as expected.
UPDATE:
Unfortunately, I had to uninstall the module for the reason that the page I set as 'blocked' would redirect to home when accessed directly, something which I do not want to happen.
-
Kay Lohn's post in 403 Forbidden when saving Homepage was marked as the answer
UPDATE:
Fortunately, I have traced the problem. (I recalled having a similar problem on MODx a few years back)
ALL of the pages which I created on local XAMPP install and migrated to the live site would throw a 403 Forbidden on save as well as pages which had content that matched the ModSecurity filters/ rules on the server. It does not like the brackets <> I guess.
The pages I created on the live site had fields which were to have HTML code but were left empty, hence no error was thrown and the page was saved gracefully.
Error log below:
[sat Jan 17 13:13:33 2015] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(< ?(?:script|about|applet|activex|chrome).*(?:script|about|applet|activex|chrome) ?>|> ?< ?(img ?src|a ?href) ?= ?(ht|f)tps?:/|" ?> ?<|" ?[a-z]+ ?<.*>|> ?"? ?(>|<)|< ?/?i?frame|\\%env)" ... [uri "/xxxx/page/edit/"]
I have a few text fields which are supposed to accept HTML code and output it as is but my host does not like it being saved to the database un-escaped.
This issue has been traced and is fixed for now by revisiting the template files PHP code and outputting the data some other way OR manually editing ALL offending entries in the database.....hmph
BTW, my host uses HSPHERE/PARALLELS and hides its Apache version