Internal Server Error - Updating Products

[djdavedawson]

When I try to update some of my products I receive an Internal Server Error once I hit preview.

zencart 1.3.8a php5

[djdavedawson]

Ok, upon further invesagation, I have isolated it to this:

Any products that contain "http://" in the description will result in an Internal Service Error upon clicking the preview button.

If I take away the "http://" they will update normally.

How do I fix this error ?

Thanks

DD

[DrByte]

http://www.zen-cart.com/forum/showth...t=mod_security
http://www.zen-cart.com/forum/showth...t=mod_security

[djdavedawson]

I tried adding this code to my .htaccess file in my admin directory:

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

I am still getting the Internal Service Error.

Thanks

[DrByte]

Then you'll need to look at your server's errorlogs for the cause.
Or ask your host to help you, since they're the ones setting up the rules for what is allowed and not allowed.

[djdavedawson]

This is what they found:

ModSecurity: Access denied with code 500 (phase 2). Pattern match "(ht|f)tps?:/" at ARGSroducts_description[1]. [hostname "www.mydomain.com"] [uri "/admin/product.php?cPath=1_3&product_type=1&pID=107&action=new_product_preview&page=1"] [unique_id "hW5lqUMrAA4AABhSFYMAAAAF"]

[DrByte]

Right ... that means they've got a rule set up to deny the use of "http:/" and "ftp:/" in any form that gets submitted on the server.

You have 4 options:
1. Don't use http:/ anywhere in your product descriptions (you shouldn't need to anyway)
2. Get your host to turn off that rule
3. Get your host to allow you to use .htaccess to turn off the rule just for your admin area
4. Find a different host (not ideal, but *is* an option)

[djdavedawson]

Are you saying that there might even be a rule that doesnot allow me to use my htaccess files also ?

This is how my admin htacess looks :

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

# $Id: .htaccess 1105 2005-04-04 22:05:35Z birdbrain $
#
# This is used with Apache WebServers
#
# For this to work, you must include the parameter 'Options' to
# the AllowOverride configuration
#
# Example:
#
# <Directory "/usr/local/apache/htdocs">
# AllowOverride Options
# </Directory>
#
# 'All' with also work. (This configuration is in the
# apache/conf/httpd.conf file)

# The following makes adjustments to the SSL protocol for Internet
# Explorer browsers

<IfModule mod_setenvif.c>
<IfDefine SSL>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</IfDefine>
</IfModule>

# Fix certain PHP values

#<IfModule mod_php4.c>
# php_value session.use_trans_sid 0
# php_value register_globals 1
#</IfModule>

# to turn off register_globals
# php_value register_globals 0


Is this correct ?

Thanks

[DrByte]

Are you saying that there might even be a rule that doesnot allow me to use my htaccess files also ?

Yes, that is true ... and only your hosting company can allow you to override that.

[djdavedawson]

Thanks for the help. My web host was able to turn that off for me.

DD