Problems with 5G Blacklist in a localhost installation

  • Resolved aldemarcalazans

    (@aldemarcalazans)


    9 years, 12 months ago

    If I enable the 5G Blacklist Firewall Rules in a localhost installation (a WordPress running over Xampp, for instance), it became impossible to log out from WordPress.

    The guilty is one of the lines added to the file .htaccess: if I manually comment it, putting a “#” before it, then it is possible to log out again, as folows:

    # 5G:[QUERY STRINGS]
    (…)
    # The guilty line, already commented, is the one below this comment:
    #RewriteCond %{QUERY_STRING} (base64_encode|localhost|mosconfig) [NC,OR]

    Another way to solve the problem is, obviously, removing the word “localhost” from the list of “forbbiden words”, leaving just base64_encode and mosconfig there.

    In my corporation, we are always doing migrations from the production server to a localhost installation, for development purposes. So, when this option is set on, on the production server, our localhost installations simply do not work!

    A suggestion: on startup, the plugin could do a check on the installation and, if it detects that it is running in a localhost installation, that line should be commented. I guess it will be enough, as that line does not create problems on login, just on log out.

    https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Contributor wpsolutions

    (@wpsolutions)

    9 years, 12 months ago

    Hi @aldemarcalazans,
    I have tried this on an XAMPP installation and I can log out with no issues when the 5G blacklist is enabled.

    I wonder what might be the difference on your installation which is causing the problem?
    When you say you cannot log out, what is the exact behaviour you are seeing?

    Have you checked the XAMPP php logs? (~\xampp\php\logs\php_error_log)

    Thread Starter aldemarcalazans

    (@aldemarcalazans)

    9 years, 12 months ago

    I have an installation with many plugins and special PHP modules activated. Probably is ocurring an incompatibility with one of them. We have this sort of problem in the past, more than once.
    So, I will do a more detailed investigation, disabling the plugins and special modules, until I find the culprit and then I will inform you by email.

    By the way: I installed your plugin, in an absolutely new and pure WordPress installation and, in fact, the 5G blacklist did not prevent me from log out!

    Regards,

    Aldemar

    Plugin Contributor mbrsolution

    (@mbrsolution)

    9 years, 12 months ago

    Hi Aldemar, can you share with us what software are you using to run WordPress locally?

    I also use Xampp for all my testing and I have no problem running this plugin and configuring many of the settings.

    Kind regards

    Thread Starter aldemarcalazans

    (@aldemarcalazans)

    9 years, 11 months ago

    Hi guys. I guess I found the culprit for this issue: an incompatibility between a WordPress plugin, called bbPress, and the .htaccess firewall rule mentioned formerly (the one that referes to “localhost”). To reproduce the problem, do as follows:

    – install WordPress 3.6 or higher in your localhost environment. Log in.
    – instal the WordPress plugin bbPress 2.5.3. Activate it.
    – insert (manually or via All In One WP Security) the 5G Blacklist Firewall Rules in the .htaccess file.
    – Now, try to log out. You will see the following message:

    Access forbidden!
You don't have permission to access the requested object. It is either read-protected or not readable by the server.
If you think this is a server error, please contact the webmaster.
Error 403
localhost
Apache/2.4.7 (Win32) OpenSSL/0.9.8y PHP/5.4.25

    – Now, deactivate the plugin. You will see that is possible to log out again.

    Regards,

    Aldemar

    Jeff Starr

    (@specialk)

    9 years, 11 months ago

    Apparently the string “localhost” is included in some URL during the log-out process when using bbPress. This can be resolved by removing “localhost” from the query-string rules in 5G.

    Edited for clarity.

    Thread Starter aldemarcalazans

    (@aldemarcalazans)

    9 years, 7 months ago

    That is right. I modified the code of the file wp-security-utility-htaccess.php, removing the word “localhost” on the following lines of code:

    $rules .= 'RewriteCond %{QUERY_STRING} ^.*(globals|encode|loopback).* [NC,OR]' . PHP_EOL;

RewriteCond %{QUERY_STRING} (base64_encode|mosconfig) [NC,OR]

RedirectMatch 403 (base64|crossdomain|wwwroot|e107\_)

    The first line belong to “Deny Bad Query Strings” configuration, while the second and third lines belong to “5G Firewall Rules”.

    After the modifications, the problems involving localhost disappeared.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Problems with 5G Blacklist in a localhost installation’ is closed to new replies.