FAQ section doesn't seem to accept Content

nicksweb

I've been using the FAQ section to make technical notes for matters agents need to follow - Say, paths they need to navigate to and make configuration changes on a Linux server.

But, I'm finding that the FAQ form will not save if I've got a / in it say in/a/path/to/a/location but if the / is in a URL it'll work.

I also find if I copy some content from a website to include in some notes it just wont Save. Even if I put it into Notepad first and then copy and paste it still wont allow the form to save.

Instead it loads to a 403 Forbidden. It's not related to any one particular website, I may grab some notes from.

I've enabled viewing source in the FAQ Answer to see if there was an issue with the HTML - I didn't find any - At on stage I thought maybe it was HTML tables that was throwing it, /, magic style quotes. I'm just not sure why it errors like this?

OS Ticket doesn't seem to record any errors for the logs.

Does anyone else experience issues such as this?

I'm using a CPANEL instance.
oSTicket v1.15.4 (6bd7884)

rothgar7

I'm not exactly sure if this is what you are referring to, but I just copied and pasted your post in a KB and saved it without an issue.

nicksweb

Here's an example from my end, just lifted some text from - How to disable How to disable IPv6 in Raspbian [WORKING].

As an added note, I have tried pasting from Web into Wordpad (To Remove some formatting) and it still wont submit. I then pasted into Notepad and then copied from their clear text and it again presented 403 error?

Screenshots attached.

KevinTheJedi

@nicksweb

You'll need to check your webserver error logs and PHP error logs for any related errors. This could also be due to your host having certain security rules. You may want to reach out to your host and see if they have security rules that are blocking the action.

Cheers.

nicksweb

KevinTheJedi Thanks Keven, I logged a request with the hosting provider today and heard back within 20 minutes, you were right there were server logs of course. Which a CPANEL instance alone wouldn't have access to. So, the hosting provider checked out the logs and added scp/faq.php?cid=2 to the ModSecurity Whitelist.

After this fix, that page is working on submission - it's odd that that page triggers a ModSecurity as from the way OSTicket is written I would have thought ticket pages etc may trigger a similar alert.

Response from provider below:

Taking a look into this one, I could see a ModSecurity rule being triggered from the FAQ page

[error] [client IPRedacted] ModSecurity: Access denied with code 403, [Rule: 'REQUEST_URI' '!@contains cpanel'] [id "XXXXX"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt"] [logdata "Matched Data: /scp/faq.php?cid=2 found within /scp/faq.php?cid=2: /scp/faq.php?cid=2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.example.com"] [uri "/scp/faq.php?cid=2"], referer: https://www.example.com/scp/faq.php?cid=2&a=add

Anyhow, I'm glad I could post about this here on the forum so should anyone have this problem in future they may be able to resolve it also.