Thread

I’m trying to update a template with PHP code and when I hit Update or Update and Finished I am presented with the site’s home page (as opposed to anything within the CP).

I did some searching in this forum and found some people experienced similar issues due to a mod_security problem.  I excitedly pasted the proper code in my .htaccess file but was met with 500 errors.  I then looked in my server logs and found no errors related to my attempts to update the template.  Between the 500 errors and lack of mod_security errors, I figured maybe that wasn’t my problem.

I started updating the template in question with chunks of the PHP code.  Once I found a chunk that caused the problem, I then started paring it down line by line until I didn’t get the problem any more.  I then tried to submit it with just the offending line and it didn’t cause the problem.  The problem reliably appears when all of the code is submitted and when certain chunks are submitted, but not when the apparently offending lines are submitted by themselves.  I’m at a loss.

One other note: this same code was submitted to a template on this site when I was running EE 1.x on this same server (although the submission took place a few years ago).

Any ideas?

Some more info:

I started working backwards from the “offending” line.  I didn’t get very far.  Basically, if the following is present, I encounter the problem (template doesn’t update):

//mysql_query($update,$db);
  echo 'Update complete.';

If I enter either line by itself, I don’t get the issue.  Also, if I remove both lines from the entire PHP code (~140 lines’ worth) I still get the problem.

I removed ALL lines containing “mysql_query” and the problem persisted.  I then removed all lines containing “echo” and the problem disappeared.  I then went and reinstated the “mysql_query” lines and the problem returned.

One other test I did: I did a find/replace to change all instances of “echo” to “hoce” and the problem persisted, then replaced “mysql” with “symql” and the problem disappeared.  Putting all the echos back makes the problem return.

I started trying to find the minimal number of characters to enter to cause the problem.  Entering just

;echo ;

does the trick, oddly enough.

Truly bizarre.

Running the latest version of EE, by the way (2.5.2 Build 20120606).

Had another idea when I awoke this morning: I removed the .htaccess file which I use to remove the index.php from my site to see if it was a mod rewrite issue.  The issue still occurs only during the aforementioned conditions, but instead of my web site I now see this:

You don’t have permission to access /access.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Does that make any sense to anybody?

Hi, Michael -

When certain content can not be submitted via the forms that usually indicates a mod_security restriction on the server. That’s something you’d need to take up with the server admins.

Alternatively, you can save templates as files and save them when editing via FTP - no form submission means no blocking.

Does that help?

Hi Lisa,

Thanks for your response.  I’ll use your suggestion to get around the problem for now.  The lack of mod_security error messages and the 500 errors I got when I tried to disable it led me to believe that wasn’t the cause.

I tried one more thing after reading your response: I submitted a channel entry with the offending lines and it gave me the same response (403 error with .htaccess disabled), so that supports your theory that I’m dealing with a server issue.  However, if I submit those same characters into the CP search field, I get search results instead of the 403 error.  So that goes against the theory (as far as I understand it, anyway).  More testing: cannot submit offending lines to notepad in CP, but can send email with offending lines via communicate form (and I received the email with the offending lines intact).

I have submitted a support ticket with my host regardless.  I’ll post here with their response…

Thank you Michael!  I look forward to hearing what they have to say.

My host disabled mod_security on my account and things are working as expected now.  Apparently not all mod_security implementations are created equal.

Thanks again for your help!

I’m glad that you got it sorted. Thank you for the update!