7

When I try to use DokuWiki to create some pages with SQL examples, if the SQL statement has stuff like select drop table and some other certain keywords, trying to save the page returns a connection reset error and doesn't save the page.

The only reference I can find to this is here:

https://www.dokuwiki.org/faq:mod_security

but I don't have ModSecurity installed and request filtering isn't configured, or at least, I haven't added anything beyond the default options to request filtering. I'm on IIS 7.5.

Any advice? The same thing happens in WordPress actually.

edit: An update I have on this. I have not resolved this issue but I have tried DokuWiki on at least 2 other machines. First I tried it on my home server and it worked fine there, obviously I was testing it there because I don't have any corporate firewalls or insanely restrictive rules in place. Did not run into the issue.

I then tried it on another spare VM we have running at work that's on the domain it's running Server 2012 R2, and it works completely fine there. No timeout's when submitting text that might have "drop table" or "select" statements in them.

Pls help. I really don't want to ask the sys admins for another random VM that will only serve one purpose.

6
  • If you uninstall IIS's Request Filtering "role service" does it still behave the same way? Jun 5, 2015 at 20:44
  • I removed it from that website only and once I do that I get a 500 internal server error. "There is a problem with the resource you are looking for, and it cannot be displayed." Jun 5, 2015 at 20:50
  • I'm not sure how you removed it from just one site so whatever you did may be causing the 500 error. I was suggesting removing the feature fully (via Roles and Features) and testing. Jun 5, 2015 at 20:53
  • Oh right, that distinction went right over my head. I'll give it a shot. Jun 5, 2015 at 20:53
  • I don't think that request filtering is an actual role service you can just remove past a certain version of IIS. I'm looking into doing this right now: serverfault.com/questions/359635/… Jun 5, 2015 at 21:00

1 Answer 1

0

For your IIS 500 error can you disable "Show HTTP Friendly Messages" in your browser and screenshot the full HTTP 500 error? Do you have an intrusion detection system or any hardware that could be interfering with the request?

I'm wondering if the HTTP 500 was because your Web.config or similar required request filtering but with the feature not available IIS was unable to fulfil so provided an error. Can you check the Web.config is not over-writing any request filtering settings?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .