WAF Still Broken (13 months later. Cloudflare blocked keywords)

[Jack]

Original report:
https://www.mc-market.org/threads/263095/

This bug was first reported over 13 months ago.

It took Ajdin 2 days to reply with an easy fix for Mick.

Mick said he would look into it, but I had to bump the thread 2 months later.
Another 8 months go by and Mick says he will discuss it with the sys admin.
It's been another 2 months and it still hasn't been fixed.

I'm hoping that with new sys admins/developer (Brent W Jayson) this can be fixed in a less absurd amount of time.

This time I wasn't even trying to type cmd*exe, here is a link to the offending text. CF probably assuming I'm trying to do an injection.. but as mentioned over a year ago, it's not necessary as XF handles such security issues.

(PS: Justis This why I, and probably others, get upset by the way things are handled on MC-Market)
(PPS: Why is d3l3t3d still an admin and Brent W not on the 'Staff Members' page?)

 

[Ajdin]

Unfortunately to this day, MC-Market lacks a consistent workflow in terms of system administration, management and team coordination. You'd think otherwise after someone has been running a site for this long.

 

[Landon]

Unfortunate that such simple things (this, the email system, the media proxy) took/are taking so long to fix. Site functionality isn't a top priority, it seems. This was reported 13 months ago, with no fix. Media proxy has been down for two months, when Mick said it'd take two days. And the email system was down for a week or so if I remember. Oh well, it might get fixed in 2020 hopefully :tup:

 

[Harry]

Unfortunate that such simple things (this, the email system, the media proxy) took/are taking so long to fix. Site functionality isn't a top priority, it seems. This was reported 13 months ago, with no fix. Media proxy has been down for two months, when Mick said it'd take two days. And the email system was down for a week or so if I remember. Oh well, it might get fixed in 2020 hopefully :tup:

And not to mention the recent downtime due to flood attacks. It's absurd, to be honest. :/

 

[Mick]

Hey Jack, can you please try again and confirm that this issue has been fixed? I'm not sure about our old setup, but with our new infrastructure, we've gone ahead and reduced our WAF's sensitivity.

Sorry about the delays once again.

 

[Jack]

Hey Jack, can you please try again and confirm that this issue has been fixed? I'm not sure about our old setup, but with our new infrastructure, we've gone ahead and reduced our WAF's sensitivity.

Sorry about the delays once again.

cmd.exe
file_get_contents
"<select" "value="
CURL
substr()
"""SELECT *

Seems fixed to me.

 

[Ally]

cmd.exe
file_get_contents
"<select" "value="
CURL
substr()
"""SELECT *

Seems fixed to me.

The question is, why would you even need to type those things on MCM?

 

[Jack]

The question is, why would you even need to type those things on MCM?

Read OP:

This time I wasn't even trying to type cmd*exe, here is a link to the offending text. CF probably assuming I'm trying to do an injection.. but as mentioned over a year ago, it's not necessary as XF handles such security issue

 

[Mick]

cmd.exe
file_get_contents
"<select" "value="
CURL
substr()
"""SELECT *

Seems fixed to me.

Perfecto, I'll move this to the bug report archives now (that took a while, sorry )

Thank you for letting us know, Jack