|
Lee Froese
|
October 5, 2015 at 3:59 pm
We have noticed an issue in EE4 related to back end search in the EE modules for Events and Venues.
When a user searches, they are taken back to the site url (www.domain.com) instead of search results. However! if I enter the search query URL in an address bar directly, everything works fine.
Example: http://www.domain.com/wp-admin/admin.php?page=espresso_events&route=default&s=EVENT NAME&_wpnonce=05f5ff2b53
I can provide login details so you can investigate.
|
|
Tony
|
October 6, 2015 at 7:27 am
Hi Lee,
That search query URL from above is different from what Event Espresso would search for, for example on a test site I can use:
http://www.example.com/wp-admin/admin.php?page=espresso_events&route=default&s=Graduated%20tickets
and the Dashboard will display the ‘Graduated Tickets’ event – http://take.ms/yoPJ9
However, if I actually search for ‘Graduated Tickets’ using the search function, this is the URL:
http://www.example.com/wp-admin/admin.php?s=Graduated+tickets&_wpnonce=b5cf23faa9&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Despresso_events%26route%3Ddefault%26s%3DGraduated%2Btickets&action=-1&active_status=none&month_range&EVT_CAT=-1&page=espresso_events&route=default&perpage=10&trash_events_nonce=36fc094593&paged=1&action2=-1&default_nonce=4d303bd0de
Exactly the same site, just used the search.
Notice the wp_http_referer value is attached and its rather long? my first check would be to see if the search query is triggering some kind of mod_security rules in place on the server, for this you’ll need to contact your host and check with them.
|
|
Lee Froese
|
October 6, 2015 at 2:06 pm
You are correct, thanks for pointing it out.
It was mod_security
Specifically, the rules/REQUEST-42-APPLICATION-ATTACK-SQLI.conf of the OWASP rule set bundled with cPanel/WHM.
Disabling this rule set fixes the issue.
Thanks again,
|
|
Seth Shoultes
|
October 6, 2015 at 9:38 pm
Thanks for letting us know. We’ll mark this as resolved for now.
|
