Support

December 24, 2014 at 6:01 am

Hi Heather,

Can you first try ‘flushing’ you permalinks by going to Dashboard -> Settings -> Permalinks.

Make no changes and simply click ‘Save Changes’.

Then retry.

Can you also try looking through your servers error log file and see if that shows any errors relating to the event pages? You can usually find this within the root directory of your site and is often called error_log or error.log.

December 26, 2014 at 11:17 am

I have the same error and I think Tony has the right explanation since it happens in the past : https://eventespresso.com/topic/ee4-4-4-4-p-and-dreamhost-mod_security-rule-interference/

I am also with dreamhost and I just opened a ticket with their support

FYI :
— Permalink flushing did not solve the problem
— Deleting the cache did not helped either

I think Dreamhost will need to adjust their mod_security again, do you have other information that I sould forward to Dreamhost ?

Thanks

December 26, 2014 at 11:49 am

Thanks Josh, I will mention that when they will get back to me !

Guillaume

December 26, 2014 at 2:00 pm

Hello,

The first answer that I got from Dreamhost is this one

I asked a security engineer and they said you can temporarily turn off
Extra Web Security in the panel -> Manage Domains -> affected domain for
the time being. They recommend that you contact the plugin/theme
developer of the code that is giving you the issue and have them
investigate your code. If any if the scripts you are using are invoking
any of the following:

wget GLOBALS base64_decode passwd ,amo! ,amo WQGP wqgp a:0:{} curl ../../

our security daemon will prohibit the action, as attackers are exploiting
sites using the above strings. The security engineer said they are going
to review the case and make adjustments where is needed, but they believe
these are legitimate blocks. Again, please contact the developer of the
script you are trying to use, so they can adjust their code. If there is
anything else you need help with, please let me know! Thanks! Have a
great day!

Anthony S

I answered by copying what Josh wrote here in my conversation to the Dreamhost support team and I added this :

So I understand why you block base64 but it seams that is needed by my plugin, Is there a way that you adjust the security settings of my domains
just to let this specific use of base64 ?

And they answered this :

Hello,

Thank you for contacting DreamHost support.

I’m sorry, but this is not possible with the current version of
modsecurity. We are planning to allow htaccess overrides, but that is
still some time away.

Please let us know if we can assist you with anything else and again, I’m
sorry that we were not able to assist you with this.

Cyrus

So my only solution is to turn off Extra Web Security like they told me in the first answer ?? Is is secure ??

December 26, 2014 at 2:09 pm

Hi there,

I cannot answer that question because I don’t know the ins and outs of your server’s set up. I can respond to this assertion the engineer makes:

“but they believe these are legitimate blocks”

If they can look in the error logs and see that they are blocking the Event Espresso ticket selector, that’s an indication that it’s not a legitimate block.

Another solution is to move to another host that’s not blocking the encoding/decoding functions that the ticket selector uses.

December 26, 2014 at 2:24 pm

Oh, I answered before seeing your last reply… Thanks for the info, I am forwarding this to them 😉

December 26, 2014 at 3:03 pm

Thanks for your help Josh.

I have also received an answer from another dremhost support staff assuring me for a quick fix about this

Have a nice holidays !!

I see the light

December 29, 2014 at 6:01 pm

Not yet, I am still waiting their answer

I will keep you updated

January 6, 2015 at 12:31 pm

Glad to hear its now working. Enjoy your week Guillaume!