Thread

The site I’m developing is running on IIS (if I could change to linux, I would…but that’s besides the point). I contacted the hosting company and had them point all 404’s to this page: http://pacmeddna.adhostclient.com/index.php/404

They changed server settings to point to the above page, but unfortunately when going to a non-existent page a “Disallowed Key Characters” message is the only thing that displays. I researched and couldn’t find a solution, but found a suggestion in this thread to change code in core.input.php so the disallowed characters are displayed:

exit('Disallowed Key Characters');

to

exit("Disallowed Key Characters: $str");

After making that temp code change I now receive this message instead:

Disallowed Key Characters: 404;http://pacmeddna_adhostclient_com:80/index_php/asdfg

My basic understanding is there’s a character in the string that isn’t allowed (the colon, maybe?), but I’m unsure what step to take at this point to resolve this problem. Any advice?

While we’ll try to work through this with you, we do not officially support redirecting of 404 pages. May I ask how exactly your host does this redirecting? Something seems to be triggering the filter.

Another question, do you have any global vars in path.php?

Below is my path.php code. I’ll ask the host how they’re doing the redirect.

<?php

// ------------------------------------------------------
// DO NOT ALTER THIS FILE UNLESS YOU HAVE A REASON TO

// ------------------------------------------------------
// Path to the directory containing your backend files

$system_path = "./[edited_system_path]/";

// ------------------------------------------------------
// MANUALLY CONFIGURABLE VARIABLES
// See user guide for more information
// ------------------------------------------------------

$template_group = "";
$template = "";
$site_url = "";
$site_index = "";
$site_404 = "";
$global_vars = array(); // This array must be associative

?>

Their reply: “We set the 404 page in IIS to be /index.php/404”

wrightmight,

I believe it is actually the underscore causing your issue.

This seems unusual as in the all the periods have been replaced with an underscore which is a disallowed key character.

In anything that I found in my research (minimal) it would appear like so

404;http://pacmeddna.adhostclient.com:80/index.php/asdfg

yet you have

404;http://pacmeddna_adhostclient_com:80/index_php/asdfg

I would go back to my your host and ask them about the underscores.

Their response: “We are not adding underscores or any other types of character; it is a simple
IIS settings for 404 errors to go to /index.php/404.”

Surely someone out there has created a custom 404 page for an EE install on a IIS server…

wrightmight, this is not occurring at any other time other than when using that redirect?

Lisa- correct, this is the only time.

I will run this past the team quickly, but in all honesty I’m not sure that we can offer support for this.  What is happening here is that the XSS Filter is being triggered which can happen with GET or POST data, including the contents of a cookie, and in this case, a redirect.

What John points out is important here, why is the redirect like:

404;http://pacmeddna_adhostclient_com:80/index_php/asdfg

instead of with periods as one would expect?  What is the redirect doing that would cause that?

Alright, I’ve checked with the dev team, what we need to identify for sure is where those URLs are coming from, can you check with your host about exactly how they’re implementing the redirect?

Feel like I’m going in circles with the hosting company, who isn’t giving me any additional info. So considering we need to launch the site on Monday, I’m going to create a static 404.html page outside of EE for the time being.

Thanks for following up with me! Hopefully I’ll get back to this eventually and figure out what’s wrong…

Thanks for the update.

Just to recap, is there any reason why you didn’t use the 404 setting in your template preferences and are using the server setting instead?

The first thing I did was change the “Templates > Template Preferences > 404 Page” setting to home/404 (where my 404 page resides, obviously), but that didn’t fix things on its own…hence needing to ask the hosting company to specify the 404 page in IIS.

So has the hosting company responded yet?

They responded, but couldn’t give me any information as to how the underscores were appearing. In the end I created a static 404.html page outside of EE and told them to redirect to that file instead.