quickmod2 error

[wibo]

Same Cookie settings here:

Enable local storage of cookies -> Unchecked
Use subdomain independent cookies -> Unchecked
Use database driven sessions -> Checked

I've cleared out my tables smf_sessions and smf_log_online tables in phpmyadmin

I renamed the cookie.

Hope this will resolve this irritating error.

[metallica48423]

try NOT using database driven sessions,

also, is your theme compatible with SMF 1.1.2?  An incompatible theme CAN cause a session timeout error.

[wibo]

I have the classic theme and I'm using smf 1.1.3

I checked the forum errors but the solutions didn't resolve the problem.

Now I tried to uncheck the database driven sessions.

Thanks again,
Wibo

[wibo]

metallica48423,

I tried to uncheck the database driven sessions.

this doesn't resolve the problem as well.
Still many errors.

[metallica48423]

And replacing all the files with Default versions does not solve the error?  (it should, really.)

I am confused now to what exactly the problem is though... for some reason i cannot follow the progression of this thread

[wibo]

Yes,

IP's are all kind of types but always guests.

There are many many different IP's so I don't believe it is an hack.

[greyknight17]

I tried almost everything in the past, including replacing the whole forum files with new ones. I just tried unchecking that database driven session option like two days ago and yesterday my forum crashed on me. I think the messages table was corrupted somehow. Coincidence I assume? I saw 34 pages of errors related to that corrupted table. I repaired that table and checked back that database driven session box for now.

Will try clearing out those two tables, but don't see any hope from this as well. Been an ongoing issue

By the way, what do those two tables contain? Anything important or interesting?

[wibo]

I cleared these two tables without success.
There are still plenty of these errors.

[wibo]

More people with same error:
http://www.simplemachines.org/community/index.php?topic=157772.0

[metallica48423]

im honestly not sure what is causing the problem then.

is this still an issue? i may need to pass it up to a developer.

please post a phpinfo.php (What is phpinfo.php?)

[wibo]

yes almost 100 errors a month.

[greyknight17]

I have just been dealing with this issue for a while now (maybe over a year I would say). I get maybe like 5-10 of these errors a day usually. Here is my phpinfo.php.

[metallica48423]

greyknight, since i'm busy and about to leave, would you mind posting this into the support topics requiring dev attention thread in the team boards.

Sorry for the rush but i gotta go :x

[greyknight17]

No problem metallica. Posted it in the team boards.

[H]

I'm following up support topics.

Is this resolved or do you still require assistance?

[greyknight17]

Nope. It looks like this will be an ongoing issue for me. I posted this in the staff development board (topic - Support requests requiring dev attention). No replies

[packman]

I assume this is some form of attempted hack. I see these, e.g.

Code Select Expand

http://www.mydomain.com/smf/index.php?amp;action=quickmod2;topic=19381.0

The most recent are from Russian allocated IP addresses. This is the only type of activity from those addresses. There are no real users associated with the addresses, no login attempts, just the attempt to run quickmod2. It's odd that the query string starts with 'amp'. Could that be an attempt to tag the quickmod2 query onto the end of another query which would then bypass some protection mechanism?

My forum is using v1.1.4, so as patched as possible.

[kitz]

Ive had this same ongoing issue for about a year and keep monitoring these forums to see if theres any update on this, but I dont see anything new. In the past Ive also tried the suggested fixes but nothing seems to stop it.

I also can get about a hundred or so of these per month - In fact Im just about to clear 16 pages of them and again they are mostly foreign IPs. (china, russia etc).
Occasionally the same IP address generates the same error several times eg see screen cap

This problem has followed me through various versions and upgrades of SMF possibly since around the time of RC2 (now on 1.1.4)


I'm no expert, but I have tried to do a bit of digging and I may be clutching at straws here... but in view of the fact that they are mostly errors generated by foreign IP addresses, could it possibly be the character set that has something to do with it?

Display template - line 235

<form action="', $scripturl, '?action=quickmod2;topic=', $context['current_topic'], '.', $context['start'], '" method="post" accept-charset="', $context['character_set'], '" name="quickModForm" id="quickModForm" style="margin: 0;" onsubmit="return in_edit_mode == 1 ? modify_save(\'' . $context['session_id'] . '\') : confirm(\'' . $txt['quickmod_confirm'] . '\');">';

[kitz]

Woaaaaah

Ive just been doing some more digging - The charset params appear to have first been introduced with 1.1 RC3 (6th Aug 2006).

So Ive just done a quick search of these forums and the first time anyone appears to have reported receiving the "action=quickmod2" error was on 12th Aug 2006.  Since then there have been quite a few threads with people reporting this particular error.

If Im sending you guys on a wild goosechase with this I apologise.....  but the time frame certainly seems to fit for me.

[kitz]

or maybe not - I'm just trying to give you guys as much info as possible to try resolve this.  But Ive just had a couple more of these errors

38.113.114.156  Guest  Unable to verify referring url. Please go back and try again.
?amp;action=quickmod2;topic=403.0  Today at 09:07:10 AM
38.113.114.156  Guest  Unable to verify referring url. Please go back and try again.
?amp;action=quickmod2;topic=403.0  Today at 12:41:24 AM

From the Who's Online

Guest (38.113.114.156)  09:07:10 AM Unknown Action

Looking up the IP address resolves to "Performance Systems International Inc. PSINETA".

Googling information on PSINETA throws up some interesting results - but nothing that is really very useful as to finding out what this "apparent bot" is up to and actually opens up even more questions that arent really relevant to this thread and I dont want to distract from the fact that its mostly foreign IPs that are doing this.

eg A few more that I got within the past few hours

217.16.16.218  Guest  Unable to verify referring url. Please go back and try again.
?amp;action=quickmod2;topic=361.0  October 06, 2007, 10:34:14 PM
217.16.16.218  Guest  Unable to verify referring url. Please go back and try again.
?amp;action=quickmod2;topic=417.0  October 06, 2007, 10:34:09 PM
217.16.16.218  Guest  Unable to verify referring url. Please go back and try again.
?amp;action=quickmod2;topic=392.15  October 06, 2007, 10:34:04 PM