Failed to Save Draft #3345

New Issue

OVERLORD · 2026-02-05T06:25:06+03:00

OVERLORD commented

2026-02-05 06:25:06 +03:00

Originally created by @pcxnet on GitHub (Nov 15, 2022).

Describe the Bug

Just upgraded to the latest version, and getting failed to save draft messages.

Error is showing in browser console 404
app.js?version=v22.10.2:25
PUT /ajax/page/174/save-draft 404

Steps to Reproduce

Edit any article

Expected Behaviour

It saves the draft successfully

Screenshots or Additional Context

No response

Browser Details

No response

Exact BookStack Version

22.10.2

PHP Version

8

Hosting Environment

Cpanel

Originally created by @pcxnet on GitHub (Nov 15, 2022). ### Describe the Bug Just upgraded to the latest version, and getting failed to save draft messages. ![image](https://user-images.githubusercontent.com/16738529/201815235-a3590188-7adc-41e1-ac12-fcfb2bc0dbe7.png) Error is showing in browser console 404 app.js?version=v22.10.2:25 PUT /ajax/page/174/save-draft 404 ### Steps to Reproduce Edit any article ### Expected Behaviour It saves the draft successfully ### Screenshots or Additional Context _No response_ ### Browser Details _No response_ ### Exact BookStack Version 22.10.2 ### PHP Version 8 ### Hosting Environment Cpanel

OVERLORD added the 🐛 Bug label 2026-02-05 06:25:06 +03:00

OVERLORD closed this issue

2026-02-05 06:25:09 +03:00

OVERLORD commented

2026-02-05 06:25:14 +03:00

@ssddanbrown commented on GitHub (Nov 15, 2022):

I see that AJAX PUT requests are also failing on your instance (Observed via 404 on homepage "Toggle details" button). Also observed cloudflare is in use which adds a point of complication. The 404s somewhat points to a server config issue, but lets gain a better idea of the state of things:

Can you provide the current output of running git status from your BookStack install directory?
Can you provide the output of rerunning each of the commands used to upgrade your BookStack instance to the latest version.

@ssddanbrown commented on GitHub (Nov 15, 2022): I see that AJAX PUT requests are also failing on your instance (Observed via 404 on homepage "Toggle details" button). Also observed cloudflare is in use which adds a point of complication. The 404s somewhat points to a server config issue, but lets gain a better idea of the state of things: - Can you provide the current output of running `git status` from your BookStack install directory? - Can you provide the output of rerunning each of the commands used to upgrade your BookStack instance to the latest version.

OVERLORD commented

2026-02-05 06:25:17 +03:00

@pcxnet commented on GitHub (Nov 15, 2022):

`[kal@tier BookStack]$ git status
On branch release
Your branch is up to date with 'origin/release'.

Changes not staged for commit:
(use "git add ..." to update what will be committed)
(use "git restore ..." to discard changes in working directory)
modified: public/.htaccess

Untracked files:
(use "git add ..." to include in what will be committed)
.env.new
composer.lock.o
public/.htaccess.o
resources/lang/en/errors.php.o

no changes added to commit (use "git add" and/or "git commit -a")
`

`[kal@tier BookStack]$ composer install --no-dev

@php -r "!file_exists('bootstrap/cache/services.php') || @unlink('bootstrap/cache/services.php');"
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
Nothing to install, update or remove
Package swiftmailer/swiftmailer is abandoned, you should avoid using it. Use symfony/mailer instead.
Generating optimized autoload files
Illuminate\Foundation\ComposerScripts::postAutoloadDump
@php artisan package:discover --ansi
Discovered Package: barryvdh/laravel-dompdf
Discovered Package: barryvdh/laravel-snappy
Discovered Package: intervention/image
Discovered Package: laravel/socialite
Discovered Package: laravel/tinker
Discovered Package: nesbot/carbon
Discovered Package: socialiteproviders/manager
Package manifest generated successfully.
59 packages you are using are looking for funding.
Use the composer fund command to find out more!
@php artisan cache:clear
Application cache cleared!
@php artisan view:clear
Compiled views cleared!
[kal@tier BookStack]$ php artisan migrate

```
Application In Production!     *
```

Do you really wish to run this command? (yes/no) [no]:

yes

Nothing to migrate.
[kal@tier BookStack]$
`

@pcxnet commented on GitHub (Nov 15, 2022): `[kal@tier BookStack]$ git status On branch release Your branch is up to date with 'origin/release'. Changes not staged for commit: (use "git add <file>..." to update what will be committed) (use "git restore <file>..." to discard changes in working directory) modified: public/.htaccess Untracked files: (use "git add <file>..." to include in what will be committed) .env.new composer.lock.o public/.htaccess.o resources/lang/en/errors.php.o no changes added to commit (use "git add" and/or "git commit -a") ` `[kal@tier BookStack]$ composer install --no-dev > @php -r "!file_exists('bootstrap/cache/services.php') || @unlink('bootstrap/cache/services.php');" Installing dependencies from lock file Verifying lock file contents can be installed on current platform. Nothing to install, update or remove Package swiftmailer/swiftmailer is abandoned, you should avoid using it. Use symfony/mailer instead. Generating optimized autoload files > Illuminate\Foundation\ComposerScripts::postAutoloadDump > @php artisan package:discover --ansi Discovered Package: barryvdh/laravel-dompdf Discovered Package: barryvdh/laravel-snappy Discovered Package: intervention/image Discovered Package: laravel/socialite Discovered Package: laravel/tinker Discovered Package: nesbot/carbon Discovered Package: socialiteproviders/manager Package manifest generated successfully. 59 packages you are using are looking for funding. Use the `composer fund` command to find out more! > @php artisan cache:clear Application cache cleared! > @php artisan view:clear Compiled views cleared! [kal@tier BookStack]$ php artisan migrate ************************************** * Application In Production! * ************************************** Do you really wish to run this command? (yes/no) [no]: > yes Nothing to migrate. [kal@tier BookStack]$ `

OVERLORD commented

2026-02-05 06:25:25 +03:00

@ssddanbrown commented on GitHub (Nov 16, 2022):

Thanks for providing those details. Upgrade command output looks okay.

Can you provide details of what's changed, or the current state of, the public/.htaccess file?

@ssddanbrown commented on GitHub (Nov 16, 2022): Thanks for providing those details. Upgrade command output looks okay. Can you provide details of what's changed, or the current state of, the `public/.htaccess` file?

OVERLORD commented

2026-02-05 06:25:28 +03:00

@pcxnet commented on GitHub (Nov 16, 2022):

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php80” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php80 .php .php8 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

@pcxnet commented on GitHub (Nov 16, 2022): ``` <IfModule mod_rewrite.c> <IfModule mod_negotiation.c> Options -MultiViews -Indexes </IfModule> RewriteEngine On # Handle Authorization Header RewriteCond %{HTTP:Authorization} . RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [L,R=301] # Send Requests To Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] </IfModule> # php -- BEGIN cPanel-generated handler, do not edit # Set the “ea-php80” package as the default “PHP” programming language. <IfModule mime_module> AddHandler application/x-httpd-ea-php80 .php .php8 .phtml </IfModule> # php -- END cPanel-generated handler, do not edit ```

OVERLORD commented

2026-02-05 06:25:33 +03:00

@ssddanbrown commented on GitHub (Nov 16, 2022):

Testing via the "toggle details" action on your instance, I can get the endpoint to work when I send it via a POST request, with a _method field to tell BookStack to treat it as a PUT request.

I don't think this is an issue with a specific version of BookStack, I get the feeling there's something in the networking chain for your instance manipulating or blocking things for PUT or PATCH (and maybe DELETE) requests.
Could be at the cloudflare layer or the webserver layer.
Check for any security settings in cpanel and/or cloudflare, (Like apache modsecurity), and try temporarily disabling them if possible to see if they have an affect on functionality.

@ssddanbrown commented on GitHub (Nov 16, 2022): Testing via the "toggle details" action on your instance, I can get the endpoint to work when I send it via a POST request, with a `_method` field to tell BookStack to treat it as a PUT request. I don't think this is an issue with a specific version of BookStack, I get the feeling there's something in the networking chain for your instance manipulating or blocking things for `PUT` or `PATCH` (and maybe `DELETE`) requests. Could be at the cloudflare layer or the webserver layer. Check for any security settings in cpanel and/or cloudflare, (Like apache modsecurity), and try temporarily disabling them if possible to see if they have an affect on functionality.

OVERLORD commented

2026-02-05 06:25:37 +03:00

@pcxnet commented on GitHub (Nov 16, 2022):

Cloudflare is not the issue, i changed my hosts and connected directly and got the same error. I'll check cpanel

@pcxnet commented on GitHub (Nov 16, 2022): Cloudflare is not the issue, i changed my hosts and connected directly and got the same error. I'll check cpanel

OVERLORD commented

2026-02-05 06:25:41 +03:00

@ssddanbrown commented on GitHub (Nov 16, 2022):

Is Bookstack doing something it shouldn't be doing?

Not really, just using some less common HTTP methods for background actions.
Sounds like the "allowed_methods" might be configurable for mod security.
Worth searching for such an option to see if you can allow PUT, PATCH and DELETE methods.

@ssddanbrown commented on GitHub (Nov 16, 2022): > Is Bookstack doing something it shouldn't be doing? Not really, just using some less common HTTP methods for background actions. Sounds like the "allowed_methods" might be configurable for mod security. Worth searching for such an option to see if you can allow PUT, PATCH and DELETE methods.

OVERLORD commented

2026-02-05 06:25:43 +03:00

@pcxnet commented on GitHub (Nov 16, 2022):

OK i just whitelisted the domain and its working now. I feel other people will have this issue, and it wasn't a problem with my old version, but for me now at least its fixed.

@pcxnet commented on GitHub (Nov 16, 2022): OK i just whitelisted the domain and its working now. I feel other people will have this issue, and it wasn't a problem with my old version, but for me now at least its fixed.

OVERLORD commented

2026-02-05 06:25:49 +03:00

@pcxnet commented on GitHub (Nov 16, 2022):

Rule Code 949110, 911100, 980130

I'll copy them here if needed ill remove those screenshots.

@pcxnet commented on GitHub (Nov 16, 2022): Rule Code 949110, 911100, 980130 I'll copy them here if needed ill remove those screenshots.

OVERLORD commented

2026-02-05 06:25:54 +03:00

@ssddanbrown commented on GitHub (Nov 16, 2022):

it wasn't a problem with my old version

BookStack has long since made such requests, perhaps your hosting environment was updated with additional security rules.

Since you've found the issue I'll go ahead and close this off.

@ssddanbrown commented on GitHub (Nov 16, 2022): > it wasn't a problem with my old version BookStack has long since made such requests, perhaps your hosting environment was updated with additional security rules. Since you've found the issue I'll go ahead and close this off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3345