mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-07 19:06:05 +03:00
Forbiden 403 when try save page with "/etc/" in content #745
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mariaczi on GitHub (Jul 17, 2018).
For Feature Requests
Desired Feature:
For Bug Reports
Expected Behavior
Save page.
Current Behavior
When we have a "/etc/" in content of the page it is not possible to save this page. I got error 403 Forbiden.
Please check if this problem occur too on your installation. I'm using shared hosting.
Steps to Reproduce
Create new page. Put in content for example
/etc/and try save it.@mariaczi commented on GitHub (Jul 17, 2018):
"Save draft" is working correctly on the same page.
I got this trace in laravel.log:
[2018-07-17 10:56:35] production.ERROR: Type error: Argument 2 passed to BookStack\Http\Controllers\Controller::checkOwnablePermission() must be an instance of BookStack\Ownable, null given, called in /path_to_app/BookStack/app/Http/Controllers/PageController.php on line 266 {"userId":1,"email":"MyLogin@server.tld","exception":"[object] (Symfony\\Component\\Debug\\Exception\\FatalThrowableError(code: 0): Type error: Argument 2 passed to BookStack\\Http\\Controllers\\Controller::checkOwnablePermission() must be an instance of BookStack\\Ownable, null given, called in /path_to_app/BookStack/app/Http/Controllers/PageController.php on line 266 at /path_to_app/BookStack/app/Http/Controllers/Controller.php:103) [stacktrace] #0 /path_to_app/BookStack/app/Http/Controllers/PageController.php(266): BookStack\\Http\\Controllers\\Controller->checkOwnablePermission('page-update', NULL) #1 [internal function]: BookStack\\Http\\Controllers\\PageController->saveDraft(Object(Illuminate\\Http\\Request), '46') #2 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): call_user_func_array(Array, Array) #3 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(45): Illuminate\\Routing\\Controller->callAction('saveDraft', Array) #4 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(212): Illuminate\\Routing\\ControllerDispatcher->dispatch(Object(Illuminate\\Routing\\Route), Object(BookStack\\Http\\Controllers\\PageController), 'saveDraft') #5 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(169): Illuminate\\Routing\\Route->runController() #6 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\\Routing\\Route->run() #7 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(30): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #8 /path_to_app/BookStack/app/Http/Controllers/Controller.php(44): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #9 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(131): BookStack\\Http\\Controllers\\Controller->BookStack\\Http\\Controllers\\{closure}(Object(Illuminate\\Http\\Request), Object(Closure)) #10 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #11 /path_to_app/BookStack/app/Http/Middleware/Authenticate.php(48): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #12 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): BookStack\\Http\\Middleware\\Authenticate->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #13 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #14 /path_to_app/BookStack/app/Http/Middleware/Localization.php(33): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #15 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): BookStack\\Http\\Middleware\\Localization->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #16 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #17 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(41): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #18 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Routing\\Middleware\\SubstituteBindings->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #19 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #20 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(67): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #21 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #22 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #23 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #24 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #25 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #26 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(63): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #27 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Session\\Middleware\\StartSession->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #28 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #29 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #30 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #31 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #32 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(59): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #33 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #34 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #35 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(102): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #36 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(660): Illuminate\\Pipeline\\Pipeline->then(Object(Closure)) #37 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(635): Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route), Object(Illuminate\\Http\\Request)) #38 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(601): Illuminate\\Routing\\Router->runRoute(Object(Illuminate\\Http\\Request), Object(Illuminate\\Routing\\Route)) #39 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(590): Illuminate\\Routing\\Router->dispatchToRoute(Object(Illuminate\\Http\\Request)) #40 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(176): Illuminate\\Routing\\Router->dispatch(Object(Illuminate\\Http\\Request)) #41 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(30): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(Illuminate\\Http\\Request)) #42 /path_to_app/BookStack/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php(58): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #43 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Barryvdh\\Debugbar\\Middleware\\InjectDebugbar->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #44 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #45 /path_to_app/BookStack/vendor/fideloper/proxy/src/TrustProxies.php(56): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #46 /path_to_app/BookStack/app/Http/Middleware/TrustProxies.php(45): Fideloper\\Proxy\\TrustProxies->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #47 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): BookStack\\Http\\Middleware\\TrustProxies->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #48 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #49 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(30): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #50 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #51 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #52 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #53 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #54 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #55 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(46): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #56 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(149): Illuminate\\Foundation\\Http\\Middleware\\CheckForMaintenanceMode->handle(Object(Illuminate\\Http\\Request), Object(Closure)) #57 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php(53): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request)) #58 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(102): Illuminate\\Routing\\Pipeline->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request)) #59 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(151): Illuminate\\Pipeline\\Pipeline->then(Object(Closure)) #60 /path_to_app/BookStack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(116): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(Illuminate\\Http\\Request)) #61 /path_to_app/BookStack/public/index.php(53): Illuminate\\Foundation\\Http\\Kernel->handle(Object(Illuminate\\Http\\Request)) #62 {main} "}@mariaczi commented on GitHub (Jul 24, 2018):
OK, I got information from my hosting company that I can disable modsecurity for the page. So I done that but the situation is the same - 403 when try to save page. I think the important information was that it is possible to save draft of the page but sometimes with lost some data of the page.
Could you tell me where are saved drafts and pages? In files, in database?
@mariaczi commented on GitHub (Jul 27, 2018):
It is a problem on my hosting - ModSecurity + Comodo WAF.