GoDaddy mod_security

[Sir Osis of Liver]

Did anyone ever come up with a fix for this?

Fatal error: require_once() [function.require]: Failed opening required '/home/content/43/12872143/html/forum/Sources/Subs-Auth.php' (include_path='.:/usr/local/php5_3/lib/php') in /home/content/43/12872143/html/forum/Sources/Security.php on line 543

Has it been addressed in 2.1?

[Arantor]

How can we resolve "the host removed the file because it tripped a really obscure, hard to diagnose security scan where it uses a function that malicious people use therefore it must be bad" problem?

[Sir Osis of Liver]

Wonder what they're scanning for.  File uploads, shows up for a fraction of a second, then disappears.  Forum owner will ask GD to disable it, don't know if they will.

[Illori]

if you upload the file with the file manager it will not disappear. we have tried to find out why files go missing but they dont tell us why.

[Sir Osis of Liver]

It's being triggered by this -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



[Sir Osis of Liver]

if you upload the file with the file manager it will not disappear.

That works, thanks.  Forum is running.  Must be something specific to ftp server.

[Sir Osis of Liver]

If you change this -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem.

[Arantor]

WTF GoDaddy.

[nend]

I haven't notice this issue, using SSH.

[vbgamer45]

If you change this -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -

Koodi [Valitse] Laajenna



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem.

I ended up running into this I changed the code to make it more hidden

Koodi [Valitse] Laajenna


eval(base64_decode('JF9SRVFVRVNUWydzZWFyY2gnXSA9ICRzbWNGdW5jWydodG1sc3BlY2lhbGNoYXJzJ10oJF9SRVFVRVNUWydzZWFyY2gnXSkgLiAnKic7CgkkX1JFUVVFU1RbJ3NlYXJjaCddID0gdHJpbSgkc21jRnVuY1snc3RydG9sb3dlciddKCRfUkVRVUVTVFsnc2VhcmNoJ10pKTs='));



[Arantor]

Suspect that will get flagged for looking like malware.

[vbgamer45]

I did it for one file. Then realized godaddy flagged also
Post.php
PersonalMessage.php
Subs-Auth.php
ModerationCenter.ph
Subs-Post.php
LogInOut.php
Subs-Editor.php
Register.php
Reminder.php

Then wrote a script to upload the file and that works. Seems like they just delete/scan the files on ftp upload..

[Aleksi "Lex" Kilpinen]

Yup, we've seen that alot. And always without exception the solution has been to upload the missing files using another method. Sucks, but that's how it is.

[Sir Osis of Liver]

Most files I've ever seen blocked was an even dozen, but hasn't happened recently.  GoDaddy has so many different server configurations, you never know what you're working with (neither do they).