Weird error on form submission

cretaceous

First I need to say this is on a website that has run fine for 7 years.
It's a booking tool - it has over 20,000 bookings that have been through it

Just a normal POST submit - this is in the administration section one level below public site
<form method='POST' class='nopad' action='index.php'>

There's a textarea entry box in there (it's a plain box not a javascript formatting textarea) and about 30 other mixed type inputs

If this exact text is in the text entry box:
IMPORTANT - power required. Please drop power from the roof.

Then the form bounces to the public part of the site one level up - and form is not submitted
The URL shows www.domain.com/administration/index.php but it displays the public home page
Now there's a mod_rewrite on front of site which will be showing the home page - but RewriteEngine is off in admin section htaccess

So if I change the text box content to
IMPORTANT - power required. Please drop power fromr the roof.

(Note spelling of 'fromr')
then it submits fine.
But there is no one thing I can remove to fix the error - like taking out the dash or the full stops or the IMPORTANT - it seems hit and miss.

Doing it via GET submission has the identical result
The page is html5 - utf 8 , but same happens if page is <doctype oldstyle strict ..etc >

Only about a quarter get that box filled in so there's about 5,000 that have worked fine

Any ideas at all what is happening?

dalecosp

How strange.

So, add this?

if (strstr($_POST['whatever'],"Please drop power from the roof.") {
   $_POST['whatever'] = str_replace("Please drop power from the roof.","Please drop prower from the roof.",$_POST['whatever']);
}

But in all seriousness, if this is an admin area (not customer-facing) issue and the bug is as WTF!? as this seems to be, I'd probably hack some JS to mis-spell "power" onSubmit() and go on with life...

You might even be able to fix the 'speling' back in the PHP handler ... ?

bradgrafelman

Check the error logs of your webserver, and check for 'security'-minded application firewall plugins.

For example, things like mod_security for Apache that attempt to provide an IDS-like function to protect your web applications. From what I've seen, they can often end up being far too overzealous when it comes to detecting an attempted security exploit.

dalecosp

Hmm. On the idea that it thinks "drop" is SQL injection?

A quick test would be to attempt to input another sentence including "drop" as a verb.... ?

bradgrafelman

I suppose (although I don't recall any SQL variants that use "DROP (something) FROM" syntax).

Like I said, I've seen them get way overzealous. Whenever I hear of strange paths/results getting hit based solely on the content of user-submitted data, I turn to things like mod_security first.

Derokorian

Edit: Nvm, ignore me....

cretaceous

Oh - stupid of me not to see 'drop from' - that's almost funny
I think you've hit the nail on the head there BradG - will report back after going through logs!

cretaceous

I figured I'd ask the host first - it's a VPS
The reply, after an initial "No, we don't do anything like that, it must be your code" was:

We have checked logs on the server and found some mod_security rules were triggered for this website.

They've switched it off now.
Many thanks BradG for applying yourself to it!