Interesting Problem With Updating/changing Packages

[RRWH]

Well, over the last day or so, I attempted to update some details and also add some packages.

 

No matter what I did, It would just sit and wait, then finally push me to the public portal page after about 15 seconds without modifying the plan.

 

Yes, it frustrated the heck out of me and finally, I realized that in the meantime, I had enabled the PHPIDS module.

 

A quick look at the logs - and voila - I could see I was triggering it based on a large amount of post data - it was including the description and the email.

 

Disabled PHPIDS, and I could actually modify and update the packages.

[Michael]

Yeah that's why it's not recommended to use it yet mate.

[Paul]

PHPIDS can be very useful, but it takes some configuration to work well. I think we should probably update the page it redirects to by default to be one that explains that PHPIDS blocked the request and has a link to the plugin.

[Michael]

PHPIDS can be very useful, but it takes some configuration to work well. I think we should probably update the page it redirects to by default to be one that explains that PHPIDS blocked the request and has a link to the plugin.

 

Could we have more options and hopefully a guide to go in the docs because so far none of us can use it lol.

[Paul]

CORE-723 for the redirect page. PHPIDS definitely should be used with caution. The way we configured it by default, it's pretty good except for updating email templates. Making it work well for that may open it up too much. It may be one of those things it's better to disable it when editing templates, and then re-enable it.

[Michael]

CORE-723 for the redirect page. PHPIDS definitely should be used with caution. The way we configured it by default, it's pretty good except for updating email templates. Making it work well for that may open it up too much. It may be one of those things it's better to disable it when editing templates, and then re-enable it.

 

Could we have it for only working on the front end?

[Paul]

Could we have it for only working on the front end?

 

It registers itself and runs early on in the application, so it's not really possible to limit its scope in any significant way. Which, I think, is by design, otherwise an attacker might be able to figure a way around it.

[Michael]

It registers itself and runs early on in the application, so it's not really possible to limit its scope in any significant way. Which, I think, is by design, otherwise an attacker might be able to figure a way around it.

I suppose, do you guys use it on Blesta.com, if so any chance you could tell us which are the best settings which suit you guys so we can try it mate?

[R.W's]

I have the same question 

I suppose, do you guys use it on Blesta.com, if so any chance you could tell us which are the best settings which suit you guys so we can try it mate?

[Paul]

I suppose, do you guys use it on Blesta.com, if so any chance you could tell us which are the best settings which suit you guys so we can try it mate?

 

Normally I would say something like "We can't release information about any security practices.", but no, we are not using PHPIDS ourselves. Not right now anyway, that may change.