some members can't send pm

[mark48]

hello

recently my host moved my forum to a new server.  since then some members cannot send pm some of the time
there is no consistency in it.  sometimes they can and sometimes they can't

they can make the pm and click on send,  then the page just keeps loading.   when they click on save a copy in the outbox it shows as sent and the copy is there.    today i got the first report of the copy not going to the outbox

i asked my host to check and they completely disabled mod_security but the problem is still there

anyone have any ideas on a fix?
thanks very much for any help

ps i apologize if i post this on a wrong board

[shadow82x]

Anything in your server error log or SMF error log?

[Burke ♞ Knight]

What web host are you using?

[mark48]

hello thanks for your replies

i thought the problem was fixed but its not,  members just stopped complaining hoping it would be fixed soon

my host is namecheap
they tell me mod_security is completely disabled

there is nothing in the smf logs and namecheap checked everything and even logged into the forum to test it but they say everything is fine

they want me to post a step by step guide to recreate the error but i can't do that because its completely random

thanks for the help

[青山 素子]

Is this error only happening to a specific set of members? Does the group of members affected ever change? If not, there must be something in common with that set and we can troubleshoot from there.

[mark48]

there is no specific set of members affected

first person to notice the problem was my co-admin,   he still has the problem most of the time,
from time to time i have the problem too but nowhere near as much as my co-admin

i have had complaints from all membergroups.  it affects old members and new members,  it affects old members that have been inactive for almost a year and now returned

today my co-admin wanted to reply a pm and couldn't.   then i logged into his admin account and couldn't send it either.  then i tried to login with my admin account and pm that same user and i couldn't,    i then logged in with a member account and still couldn't pm that member

as namecheap asked for a guide to recreate the error i asked them to login with my co-admins account and try to contact that same member.    they did and they did not have any problem sending the pm   

namecheap has been very patient but say: 

There are no php errors in regards to this, web-server logs are empty on this as well. The server performance is stable and the issue in fact does not show itself from our end. We can not exclude a possibility that the issue is connected with SMF code itself.

i find that really hard to believe because my forum has been around for years and did not have a problem until we moved server

[butch2k]

Anything in your browser's console when sending PMs ?
Any custom mod affecting the PMs or the editor ?

[ayman20068]

I'd like to follow up on my partner post since i'm the developer working on this forum

Now the issues started after we moved to a different server by the host

The new server is using :

PHP 5.3.27
Running PHP as CGI/FastCGI
We are using localized php.ini file in which i checked all functions needed to run smf exist
I disabled mod_security on from apache so it shouldn't be affecting the forum

Now the problem happens when some members ( including myself and i'm admin ) try to send pms or reply to posts , The page just freezes and a time out message shows , Although the pm is most likely sent but the page doesn't redirect after that

The forum is using smf 2.0.6 and i ran a full clean upgrade on forum and re-installed all mods again
Also i tested it in default theme to confirm it's not theme problem and rechecked after the upgrade directly and it also existed

My best bet is that it's something related to how smf works with apache but i can't be sure , Browser doesn't show any thing in error logs so i hope you can give me opinions or ideas of what could be the reason or how to solve this

Regards
ayman

[butch2k]

Is there anything at all in SMF error logs ?
Anything in MySQL logs or the syslog  ?

[ayman20068]

Is there anything at all in SMF error logs ?
Anything in MySQL logs or the syslog  ?

I cleared all forum error logs before testing a pm sending then when i got the problem , nothing showed in error logs at all , Also nothing in logs in cpanel , I'm on shared hosting so don't have access to mysql logs , But the pm shows in sent history , So i don't think there's any problem from mysql side

[butch2k]

do you encounter the same error when running php as mod_php or php fpm ?

In chrome, with dev tools open, is there anything in the network tab, a 404 ? or an aborted connection ?

[ayman20068]

do you encounter the same error when running php as mod_php or php fpm ?

In chrome, with dev tools open, is there anything in the network tab, a 404 ? or an aborted connection ?

I can't change php mod since i'm on shared hosting so really can't tell if this problem would happen when running php as mod_php

In chrome dev tools the network doesn't show anything

This shows while pm is sending



This shows after it [ I added full page so you see redirect url in browser and full message in chrome network area ]

[butch2k]

Tested a bit on your forum, i managed to get a 408 error, there is most mprobably some kind of misconfiguration server side, it's not SMF responsible for this king of errors.

[ayman20068]

I got the following reply from the host :

Also you could contact SMF support to get information about optimal suhosin parameters for their script.

The server is using suhosin as extra security and it seems to be blocking some pms some times

This is part of the logs showing blocking pm sending

Code Select Expand


Nov 3 10:03:50 premium7 suhosin[20682]: ALERT - configured GET variable value length limit exceeded - dropped variable 'action' (attacker '87.109.95.39', file '/home/clitw/public_html/index.php')
Nov 3 10:36:58 premium7 suhosin[66964]: ALERT - configured GET variable value length limit exceeded - dropped variable 'action' (attacker '142.4.208.54', file '/home/clitw/public_html/index.php')
Nov 3 17:08:51 premium7 suhosin[645311]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'action' (attacker '209.235.156.67', file '/home/clitw/public_html/index.php')
Nov 3 18:13:08 premium7 suhosin[724709]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'action' (attacker '173.244.71.28', file '/home/clitw/public_html/index.php')


So is there any thing that can be modified in script to fix this , Or it's all server side now ?

[kat]

I suspect that attaching that index.php file, to your next post, might help ol' Butch, with this.

[ayman20068]

- Hello , I attached index.php file , We only have tinyportal install , Don't think anything else should be conflicting with PMs in that file

[butch2k]

It seems a pretty standard index.php, nothing stricking me as unusual, the problem is probably elsewhere, could you ask your host if they have more detailled suhosin logs ? It would be interesting to see the actual content of the variable "action" being dropped.

Could you list the mods you have installed ?

[Arantor]

Suhosin doesn't understand SMF style URLs, something like index.php?action=pm;sa=send;f=inbox;pmsg=12345;u=12345 is going to show up in the GET as having only the action parameter and the rest in a very long value for such (because SMF fixes it up)

This is something I have been thinking about tackling in SMF 3.0 to do it totally differently :/

[butch2k]

@Arantor
That's what i figured as well, but when i used suhosin i do not remember having such issues (probably the suhosin.get.max_value_length which is set awfully low) and never encountered the ASCII-NUL issue either. Any idea what could be responsible for the later ?

[Arantor]

That's broadly what I was thinking but I'm not familiar enough with Suhosin to know the specifics.

As for the ASCII-NUL issue, PHP doesn't use null-byte terminated strings, and generally there should never be null-byte strings kicking around, certainly not in URLs... but the thing is, there's no way to tell from those logs if it is actually someone trying to abuse PMs or not. There are however automated attack bots that try to use them...

[butch2k]

That was my first though as well but the IPs seem pretty legits: California and Texas and not registered as spambot adresses.

[mark48]

i thought i would just update this in case anyone ever has the same problem

we have all the spambot protection and those ip aren't registered on the forum so i don't think they can abuse pm

namecheap was good and really tried to help but in the end just moved us to a different server and nobody has complained for a week so that seems to have fixed the problem

special thanks to butch2k and everyone here for the support and help