(not a PW issue but) Saving/Creating Pages Broken on IONOS due to Global WAF Rule Updates

[diogo]

Hey everyone,

If you suddenly find yourself unable to create new pages or edit the name of an existing page on certain hosting providers, this is not a ProcessWire core bug.

Recently, major hosting providers (specifically confirmed on IONOS and Mittwald in Germany) seem to have rolled out a Web Application Firewall (WAF) rule update. This security baseline aggressively blocks any incoming POST requests containing the string "page_name".

Because PW uses "_pw_page_name" when you create a new page or edit the name on an existing page, the host's firewall drops the request entirely before it even reaches PW, throwing a 403 error.

Cloning pages works completely fine because it executes programmatically via the internal API, which bypasses the form submission block.

I came up with a temporary workaround for my own websites. Just add this to your ready.php. It does something very simple and non destructive, using hooks, we modify the input name on the form to something that doesn't trigger the firewall, and after we receive it via POST request, we change it again to the variable that PW is expecting:

/**
 * Temporary WAF bypass hack for 'page_name' parameter.
 * Renames the page name input on render to avoid WAF rules blocking the
 * '_pw_page_name' parameter name, then restores the value under the
 * expected key before ProcessWire processes the form input.
 */

// 1. Rename the input on render (output)
$wire->addHookAfter('InputfieldPageName::render', function(HookEvent $event) {
    $event->return = preg_replace(
        '/(<input\b[^>]*\bname=)("|\')_pw_page_name\2/',
        '$1$2_pw_bypass_waf_pg_name$2',
        $event->return,
        1
    );
});

// 2. Inject the bypassed value back under the expected name before processing
$wire->addHookBefore('Inputfield::processInput', function(HookEvent $event) {
    $input = $event->arguments(0);

    // Only act if our bypass parameter exists and the original doesn't
    $bypass = $input->_pw_bypass_waf_pg_name ?? null;
    if ($bypass !== null && !$input->_pw_page_name) {
        $input->_pw_page_name = $bypass;
    }

    $event->arguments(0, $input);
});

I opened an issue here https://github.com/processwire/processwire-issues/issues/2351

EDIT: I can't reproduce this anymore on Mittwald, so I'll assume it only affects IONOS.

[Tiberium]

Thank you so much! I'm boxing witht he AI-Mail support of IONOS since thursday.
Funny thing is, on Mittwald, everything is fine! But we have no "standalone"-Webhosting by Mittwald. We have a vServer and an "Agentur-Server" fromt he last tarif generation.

 

Quote

This security baseline aggressively blocks any incoming POST requests containing the string "page_name"

And how's brilliant idea was that? What is the reason for blocking that keyword in general?

[diogo]

23 minutes ago, Tiberium said:

And how's brilliant idea was that? What is the reason for blocking that keyword in general?

most probably something with wordpress 🙄

[Tiberium]

There was the WordPres CVE running and IONOS had and also problems and even (force silent) install a plugin who close the CVE to all WordPress installation, who where installed via their app center. So that was the reason for the suspecions timing.... -.- 

I hate that, that their use the WAF for it, and you can't even Opt-Out of it.

[Markus Thomas]

2 hours ago, Tiberium said:

Funny thing is, on Mittwald, everything is fine! But we have no "standalone"-Webhosting by Mittwald. We have a vServer and an "Agentur-Server" fromt he last tarif generation.

I can confirm, there is no problem with Mittwald.

[AndZyk]

Thank you @diogo very much for this workaround. I had already a call with 1&1 last week about this, but they have not fixed it yet.

[diogo]

To quickly test many of your websites to know if they are affected by this, you can use this cURL in the terminal, just edit the urls:

urls=(
  "https://example1.com/"
  "https://example2.com/"
  "https://example3.com/"
)

printf "%-45s %-12s %-12s\n" "URL" "page_name" "pg_name"

for url in "${urls[@]}"; do
  a=$(curl -s -o /dev/null -w "%{http_code}" -X POST -d "page_name=test" "$url")
  b=$(curl -s -o /dev/null -w "%{http_code}" -X POST -d "pg_name=test" "$url")
  printf "%-45s %-12s %-12s\n" "$url" "$a" "$b"
done