Bug? inline CKEditor not saving

[OviS]

Hi,

I ran into this problem recently and I really need to use inline CKEditor fields on my pages. 

Steps to reproduce:

1. Download and install the latest version of PW (either 2.8.33 or 2.7.2 behave the same way for me).
2. I used the "Blank" profile when installing.
3. Create a "body" Textarea field and set it to use CKEditor and save it. 
4. Add it to the only existing template for the homepage.
5. Switch the "body" field to inline, save it.
6. Edit the homepage by putting anything into the "body" field and saving.

Expected behavior at this point:

• the field should save its contents and show them after the page reloads

What actually happens:

• the field is reverted to its previous state after the page reloads
• if it had content before (that was inputted when the field was not in inline mode) then it will revert to that content
• if it had no content, it reverts to being empty.

Errors:

• There are no errors being generated in the PW logs.
• There are no errors being outputted to the Dev Console.
• There are no server errors in the log.

Environment config

Running the latest version of Scotch Box Vagrant: 

• OS: Ubuntu 14.04 LTS
• Web Server: Apache 2.4.16
• PHP: 5.6.14-1+deb.sury.org~trusty+1
• PHP Modules: attached in txt file
• MySQL: 5.5.46-0ubuntu0.14.04.2

I'm thinking this couldn't be happening just for me since it's a very obvious bug, but it's happening on the production servers (apache 2.2 and php 5.5) as well as the dev box.

Could it be a server configuration issue?

Thanks!

php_modules.txt

[horst]

mod_security?

[OviS]

Tried:

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

in the .htaccess file, but still not working

[BitPoet]

Depending on how mod_security2 was built, it might not be possible to disable it in .htaccess.

[OviS]

Thanks, am looking into how to disable it via server config now, will post back with results.

[OviS]

I don't think mod_security is installed on de dev box, because:

apachectl -M | grep --color security

returns nothing and 

apachectl -M

returns:

 core_module (static)
 so_module (static)
 watchdog_module (static)
 http_module (static)
 log_config_module (static)
 logio_module (static)
 version_module (static)
 unixd_module (static)
 access_compat_module (shared)
 alias_module (shared)
 auth_basic_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 expires_module (shared)
 filter_module (shared)
 headers_module (shared)
 include_module (shared)
 mime_module (shared)
 mpm_prefork_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 status_module (shared)

Also, 

# ls -l /var/log/apache2/modsec_audit.log
ls: cannot access /var/log/apache2/modsec_audit.log: No such file or directory

Am I looking in the wrong places?

[szabesz]

You can use @adrian's Tracy Debugger module to inspect it:

It is in the ProcessWire Info panel. If "Versions List" is enabled in the module's settings, then you get a "Versions List" listing in the panel, where "mod_security: 1" should show up if it is enabled or "mod_security: " if ti is not:

 

Edited September 30, 2016 by szabesz
added link to a more up-to-date screenshot

[adrian]

@szabesz - Thanks for the pointer to Tracy for this. Unfortunately, of everything in that list, mod_security is the one thing that can't be reliably confirmed as not installed, because PHP can't determine this for PHP-FPM - it only works if php is installed as an apache module. A positive "1" should confirm that mod_security is installed, but a false result unfortunately can't confirm that it isn't.

I might add an additional check to show if the negative is confirmed - that I think we can do.  

[OviS]

thanks for pointing me to the Tracy Debugger module, wasn't aware of it, looks  like an awesome tool even if I can't use 90% of its features because they're above my  knowledge level.

The Tracy Debugger shows that it can't detect mod_security as being installed ("mod_security:   "). Even though it's not a hard confirmation, it's consistent with what I found snooping around via SSH into the server.

Thanks for all the help so far! Any ideas where to go from here?

 

[Robin S]

Just to confirm - you can use CKEditor in normal "Regular Editor" mode, and it's only if you change to "Inline Editor" mode that a problem occurs?

I just tried CKEditor in inline mode in a fresh install of PW 3.0.35 and it worked normally so I think it must be something specific to your environment rather than a PW bug.

[OviS]

Yes the CKEditor works perfectly in Regular mode, it's just the Inline mode that's not saving.

I just tried it on a fresh install of 3.0.35 - same problem, so like I thought it must be a problem with the server config, I'm just trying to find out what it is.

I just tested it in a fresh install of 3.0.35 on yet another host - a shared one with a very reliable server config which I use as a staging server before deployment to production. Same buggy behavior is present.

If it's not mod_security - since it's not installed - what could it be?

EDIT: if we rule out a PW bug, and we rule out a Server config issue, the only remaining option is a bug with CKEditor itself - but I don't know what in my environment could be causing it.

Edited October 1, 2016 by OviS

[OviS]

Finally figured it out (faceplam moment): a browser extension was messing with CKEditor inline mode and preventing it from saving. There were no errors because the browser extension was not passing it the content I was entering, it was just making it look like it.

For the record, the browser extension is Grammarly. 

I should feel wiser for figuring this out, somehow I don't 

Thanks to everyone for your help with this!