CMSMailer "Not permitted" error shown but works OK

[paulbaker]

This has happened with multiple versions of CMSMS for as long as I remember with my host (I suspect it's a hosting issue) but it's not a big issue, so I have only just got round to documenting it.

Plain vanilla install. CMSMS 1.11.6.

Go to Extensions -> CMSMailer. Change Mail method dropdown to "mail". Press Submit.

Popup asks "Write current values to CMSMailer settings?" Press OK.

I get a white screen with text showing top left "Not permitted".

Press back. Clicking another page and returning to the CMSMailer page confirms the Mail method change has been saved, it is now set to "mail".

Then:

At the bottom of the CMSMailer page I enter my email in the "Test Email Address" box and press the Send Test Message button. Same "Not permitted" message appears. But the test email is sent and received OK.

Not a big issue because, as you can see, the system is actually working OK despite the error. But just wondered what the cause was? Can't find anyone else on the forum with a similar problem.

----------------------------------------------
Cms Version: 1.11.6
Installed Modules:
CMSMailer: 5.2.1
CMSPrinting: 1.0.4
FileManager: 1.4.3
MenuManager: 1.8.5
MicroTiny: 1.2.5
ModuleManager: 1.5.5
News: 2.12.12
Search: 1.7.8
ThemeManager: 1.1.8

Config Information:
php_memory_limit:
process_whole_template:
output_compression:
max_upload_size: 32000000
url_rewriting: none
page_extension:
query_var: page
image_manipulation_prog: GD
auto_alias_content: true
locale:
default_encoding: utf-8
admin_encoding: utf-8
set_names: true

Php Information:
phpversion: 5.3.18
md5_function: On (True)
gd_version: 2
tempnam_function: On (True)
magic_quotes_runtime: Off (False)
E_STRICT: 0
E_DEPRECATED: 0
memory_limit: 128M
max_execution_time: 120
output_buffering: 4096
safe_mode: Off (False)
file_uploads: On (True)
post_max_size: 8M
upload_max_filesize: 32M
session_save_path: /tmp (1777)
session_use_cookies: On (True)
xml_function: On (True)
xmlreader_class: On (True)

Server Information:
Server Api: cgi-fcgi
Server Db Type: MySQL (mysqli)
Server Db Version: 5.1.68
Server Db Grants: Found a "GRANT ALL" statement that appears to be suitable

----------------------------------------------

[paulbaker]

One more thing on the subject of CMSMailer.

The same 1.11.6 system is currently showing "You have 1 unhandled notification" top left. When you click this, the popup explains

Your mail settings have not been configured. This could interfere with the ability of your website to send email messages. You should go to Extensions >> CMSMailer and configure the mail settings with the information provided by your host. This test is generated on an infrequent basis. It may take some time for it to go away

The Extensions >> CMSMailer is linked to

"http://www.example.com/admin/moduleinte ... _=bad2d3cd

But I change my admin directory names (for security) and so this link (with ".../admin/...") gives a 404 error.

The CMSMailer popup notification is ignoring the current admin directory as specified by the $config['admin_dir'] = '......'; line in config.php. It should be changed to respect this.

[calguy1000]

i did a search for 'Not permitted' recursively through all files in the system and could not find a precise map. Not even in the CMSMailer directory.

Code: Select all

rob@rob-GA-78LMT-S2P:/nfs/ubuntu/cms_dev$ find . -name '*php' -exec grep -i 'not permitted' {} /dev/null \;
./admin/lang/ext/cs_CZ/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/el_GR/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/tr_TR/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/fa_IR/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/en_CY/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/pt_PT/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/fa_FA/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/pl_PL/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/fi_FI/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/ext/lt_LT/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./admin/lang/en_US/admin.inc.php:$lang['admin']['error_contenttype'] = 'The content type associated with this page is invalid or not permitted';
./lib/misc.functions.php:                       // If the hyphen is used, it is not permitted to appear at
./lib/smarty/sysplugins/smarty_internal_compile_private_special_variable.php:                    $compiler->trigger_template_error("(secure mode) super globals not permitted");
./lib/smarty/sysplugins/smarty_internal_compile_private_special_variable.php:                    $compiler->trigger_template_error("(secure mode) super globals not permitted");
./lib/smarty/sysplugins/smarty_internal_compile_private_special_variable.php:                    $compiler->trigger_template_error("(secure mode) constants not permitted");

I suspect that the 'Not permitted' problem is mod_security rearing its ugly head again.

[velden]

And those mod_security errors are often visible in apache error log.

Some host are willing to disable mod_security on request. (Of course you tell them that you're using a very secure cms and NOT Wordpress).

[paulbaker]

Thanks for the replies.

Well I checked in the CMSMS admin log - nothing relevant.

And I checked I checked for PHP errors in all these directories - nothing.
/vfadmin/ (my admin directory)
/modules/CMSMailer/ and all below that

I changed the name of /vfadmin/ back to /admin/ just in case it was that - no change.

My host implements mod_security but they whitelist the mod_security rule 950004 for me (which stops you being able to click on the left hand menu and open/close sub-menus in OneEleven theme).

[calguy1000]

The 'Not permitted' message could be your servers standard 403 error message.

I suggest you repeat the problem then check your access log for 403 or 404 errors.

[Rolf]

Thanks Calguy. I tried to send a test email and the errors shown were

[Fri May 10 00:14:34 2013] [error] [client n.n.n.n] File does not exist: /home/vinfront/public_html/404.shtml
[Fri May 10 00:14:34 2013] [error] [client n.n.n.n] File does not exist: /home/vinfront/public_html/favicon.ico

There is no styling on the "Not Permitted" output (just plain text) and the URL for this (when I choose to send a test email) is:
"http://www.example.com/vfadmin/modulein ... %20Message

[paulbaker]

Thanks Rolf. Didn't notice the user/pass there. Now changed password.