Cant save changes...

[stonebridge]

Version: 1.11.11 "San Cristobal"

Hi all,

It had been a little while since I had done an update on the content on my site. Recently, I made some edits but when I hit "apply" nothing happens. When I hit "Submit" it takes me to a blank page.

Can anyone offer any hints as to what I need to look at?

Thank you,

[velden]

First of all: you should update to the most recent version of CMS Made Simple. Yours is old, vulnerable and not supported anymore.

Regarding your problem it MIGHT have to do with mod_security on the web server. I've seen it happening before when I tried to add a <__iframe> code in some content block.
You could try to (temporarily) enter some basic/plain text and see if you can update/submit.

If so, ask the hosting provider to change the rules (or disable mod_security).

[DIGI3]

mod_security is a likely culprit. You might also want to check your PHP error log; your host may have upgraded PHP or something. The log should give you some clues as to what's going on.

[stonebridge]

Thank you gentlemen for your responses.

I do plan on updating. I guess I am a little concerned about trying that until this issue is resolved.

The hosting provider has changed hands, and perhaps something has changed when they took control.

The Php version is 5.4.45. Would this later version be a problem? I do not know if they upgraded from another version, as I have not made changes in the site for over 6 months. Maybe something happened in the interim.

I am going to ask about mod_security. I will ask what the settings are.

Once again, thank you.

[DIGI3]

5.4.45 should be fine for CMSMS 1.x, so that's probably not the issue (but still check your error logs, seriously they save a lot of guesswork). Also make sure to clear your site cache and browser cache, and check for any warnings on the System Information page.

When you start the 2.x upgrade process, you'll want to upgrade to PHP 5.6.x or 7.1.x before you get to CMSMS 2.2.7. I would suggest getting the cms to 1.12.2, then upgrading php, then upgrade the cms to 2.2.7 (following all the steps on the docs site - there's a fair bit to it)

[stonebridge]

I was able to perform a differential back up to 1.11.12, but the problem still remained. I then went to CMSMS system information and found this:

Check database access levels (server_db_grants)

"could not find a suitable "grant all" permission. this may mean you could have problems installing or removing modules. or even adding and deleting items, including pages"

So, I checked my config.php file to match login info with the database login info. It did. Then I went to database permissions and I had found that somehow many of the database permissions had been changed from "All permissions" to, specified permissions. Things like table changes, execution and others were not checked.

After setting the database to allow all changes for Administrator, I found:

"Success found a "grant all" statement that appears to be suitable."

I then cleared the cache again, both on the CMS and the Browser.

I can't imagine how that happened, but in any event it did not solve my issues.

I also asked about mod_security, and they were not willing to release that information.

I was thinking my next step would be to do a full upgrade. I don't know if that would help, but maybe a file is corrupt or something?

Finally, I located the error log and found several errors in ModSecurity.

PCRE limits exceeded with code 400.

I have a ticket in again, but the last time they told me that the issue was with the CMS.

Thank you for the help again.

[DIGI3]

You'll most likely need to find a more cooperative host. They must be willing to either disable mod_security, or remove specific rules.

I've found newer versions of CMSMS actually trigger more mod_security rules, so it ends up being a game of whack-a-mole. Each time something doesn't work, you need to send the host the exact time it happened, they can check the mod_sec log and disable that rule (or find an upgraded version). Then you're on to the next thing.

You will find it very difficult to receive support from any of us as long as mod_security is enabled, as there's no way to determine if it's the culprit or not without disabling it.

[stonebridge]

Thank you for the follow up, and so quickly too.

I guess at this point, my next question would be, is there a list of suggested hosting companies good for CMSMS? It seems like I would be jumping through a lot of hoops to find a hosting company, just to discover that the CMS wouldn't work there either.

Thanks again for the help,

[DIGI3]

Just FYI, it's not a CMSMS exclusive thing - All of the major CMS's (Wordpress, Joomla, Drupal, etc) will have problems with ModSecurity. The only difference is that hosts may be more familiar with them and apply specific rule updates more quickly.

We have tested our two hosting partnerss, A2 and HostPapa, and haven't run into any issues with either. If you use one of these, please consider going through one of our affiliate links to help support CMSMS: https://www.cmsmadesimple.org/partners/

Most hosting companies are pretty cooperative with adjusting mod_security or allowing you to disable it site by site. The host I use, for example, just has a switch in cPanel I can use to disable it per domain. You can always email a host ahead of time and ask if they offer anything like this.