Jump to content
  • 0

Interesting Problem With Updating/changing Packages


RRWH

Question

Well, over the last day or so, I attempted to update some details and also add some packages.

 

No matter what I did, It would just sit and wait, then finally push me to the public portal page after about 15 seconds without modifying the plan.

 

Yes, it frustrated the heck out of me and finally, I realized that in the meantime, I had enabled the PHPIDS module.

 

A quick look at the logs - and voila - I could see I was triggering it based on a large amount of post data - it was including the description and the email.

 

Disabled PHPIDS, and I could actually modify and update the packages.

Link to comment
Share on other sites

9 answers to this question

Recommended Posts

  • 0

PHPIDS can be very useful, but it takes some configuration to work well. I think we should probably update the page it redirects to by default to be one that explains that PHPIDS blocked the request and has a link to the plugin.

 

Could we have more options and hopefully a guide to go in the docs because so far none of us can use it lol.

Link to comment
Share on other sites

  • 0

CORE-723 for the redirect page. PHPIDS definitely should be used with caution. The way we configured it by default, it's pretty good except for updating email templates. Making it work well for that may open it up too much. It may be one of those things it's better to disable it when editing templates, and then re-enable it.

Link to comment
Share on other sites

  • 0

CORE-723 for the redirect page. PHPIDS definitely should be used with caution. The way we configured it by default, it's pretty good except for updating email templates. Making it work well for that may open it up too much. It may be one of those things it's better to disable it when editing templates, and then re-enable it.

 

Could we have it for only working on the front end?

Link to comment
Share on other sites

  • 0

Could we have it for only working on the front end?

 

It registers itself and runs early on in the application, so it's not really possible to limit its scope in any significant way. Which, I think, is by design, otherwise an attacker might be able to figure a way around it.

Link to comment
Share on other sites

  • 0

It registers itself and runs early on in the application, so it's not really possible to limit its scope in any significant way. Which, I think, is by design, otherwise an attacker might be able to figure a way around it.

I suppose, do you guys use it on Blesta.com, if so any chance you could tell us which are the best settings which suit you guys so we can try it mate?

Link to comment
Share on other sites

  • 0

I suppose, do you guys use it on Blesta.com, if so any chance you could tell us which are the best settings which suit you guys so we can try it mate?

 

Normally I would say something like "We can't release information about any security practices.", but no, we are not using PHPIDS ourselves. Not right now anyway, that may change.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...