|
SixuLLC
|
August 15, 2017 at 11:57 am
I recently upgraded this site from EEv3 to EEv4. I’m receiving a page not found error when I click on Registrations CSV Report button.
I saw a previous post that asked to check to see that the file for generating reports was present, and it is. That same post also suggested removing the strip-slashes code which did not help. Any ideas?
Below is the URL that is showing the not found error (real domain name removed).
https://domain.com/wp-admin/admin.php?page=espresso_batch&return_url=%2F%2Fdomain.com%2Fwp-admin%2Fadmin.php%3Fpage%3Despresso_registrations&action=default®istrations_report_nonce=95d59ccff5&batch=file&filters=a%3A5%3A%7Bi%3A0%3Ba%3A1%3A%7Bs%3A6%3A%22STS_ID%22%3Ba%3A2%3A%7Bi%3A0%3Bs%3A2%3A%22%21%3D%22%3Bi%3A1%3Bs%3A3%3A%22RIC%22%3B%7D%7Ds%3A4%3A%22caps%22%3Bs%3A10%3A%22read_admin%22%3Bs%3A24%3A%22default_where_conditions%22%3Bs%3A15%3A%22this_model_only%22%3Bs%3A8%3A%22order_by%22%3Ba%3A1%3A%7Bs%3A8%3A%22REG_date%22%3Bs%3A4%3A%22DESC%22%3B%7Ds%3A5%3A%22limit%22%3Ba%3A2%3A%7Bi%3A0%3Bi%3A0%3Bi%3A1%3Bi%3A10%3B%7D%7D&job_handler=EventEspressoBatchRequest%5CJobHandlers%5CRegistrationsReport&default_nonce=255432c2a2&return=registrations_report
|
|
Josh
|
August 15, 2017 at 2:13 pm
Hi there,
This may be the result of an .htaccess rule or a security plugin (or a combination of both). Are there any security plugins installed on your website?
|
|
SixuLLC
|
August 15, 2017 at 2:19 pm
Yes there absolutely are. I can remove them all, but they are there for a reason so any suggestions would be much appreciated. What type of rule in the htaccess might be causing this?
|
|
Josh
|
August 15, 2017 at 2:22 pm
You’ll probably need to drill down through the settings to find the setting and deactivate it to allow the download CSV URL to do its job. Usually there’s something like a “filter long URL strings” setting that you’ll deactivate.
|
|
SixuLLC
|
August 15, 2017 at 2:48 pm
OK. That was it. For anyone else that sees this issue here was my solution. I am using the All In One WP Security plugin. There were two settings causing this issue.
Setting number 1: WP Security > Firewall > Additional Firewall Rules (tab) > Bad Query Strings (section) > Deny Bad Query Strings (check-box).
The More Info link for this setting states:
This feature will write rules in your .htaccess file to prevent malicious string attacks on your site using XSS.
NOTE: Some of these strings might be used for plugins or themes and hence this might break some functionality.
You are therefore strongly advised to take a backup of your active .htaccess file before applying this feature.
Setting number 2: WP Security > Firewall > 6G Blacklist Firewall Rules (tab) > Enable legacy 5G Firewall Protection (check-box).
The Enable 6G Firewall Protection (check-box) caused this issue as well. Best to leave both unchecked.
The More Info link for this setting states:
This setting will implement the 5G security firewall protection mechanisms on your site which include the following things:
1) Block forbidden characters commonly used in exploitative attacks.
2) Block malicious encoded URL characters such as the “.css(” string.
3) Guard against the common patterns and specific exploits in the root portion of targeted URLs.
4) Stop attackers from manipulating query strings by disallowing illicit characters.
….and much more.
Thanks for pointing me in the right direction.
|
|
Josh
|
August 18, 2017 at 2:21 pm
Thanks for the detailed follow up. I updated the “Known third party plugin conflicts” page with some information about that plugin:
https://eventespresso.com/wiki/known-third-party-plugin-theme-conflicts/#all_in_one_security
|
