Author Topic: Overactive IDS in 4.3.3 (Read 19615 times)

Shawn_LaLucha · July 04, 2013, 10:26:44 am

I'm a little bit new to the CiviCRM community and generally to participating in open source projects on this level, so pardon me if this appears obvious.

I am having an issue where each time I attempt to upload a photo to a contact I get an IDS kick (see below). Since it had worked previously and stopped suddenly (not after making any administrative changes) I believe it to be this issue:
http://issues.civicrm.org/jira/browse/CRM-12197

Am I correct that there isn't a solution to this issue currently? Until version 4.5..? Is there a fix or way around this problem? At present none of my users are able to edit contacts (in any way).

Thanks all.

CiviCRM 4.3.3, Drupal 7

Error:

{"IP":"....","error_code":"IDS_KICK","level":"security","referer":"\/civicrm\/contact\/add?reset=1&context=search&action=update&cid=11","reason":"XSS suspected","is_error":1,"error_message":"There is a validation error with your HTML input. Your activity is a bit suspicious, hence aborting"}

JonGold · July 04, 2013, 12:28:46 pm

n Civi 4.3 with Drupal, there's a permission in the Drupal permissions to bypass the IDS for certain roles. If these are authenticated users, perhaps that presents a solution?

Jon

Shawn_LaLucha · July 06, 2013, 11:04:59 am

I thought that was the case, but am unable to find the bypass IDS option in the permission when I look at them (in Drupal).

I apologize for not being more specific previously, I should mention that I am using Commerce Kickstart.

I'm just not sure I understand why the option to bypass IDS does not appear - can you tell me which subheading it should be under?

Is there any other way to set that option (config file, in db, etc)?

Thanks!
Shawn

JonGold · July 06, 2013, 11:56:53 am

Hi Shawn,

My mistake - I saw that pemission in Civi 4.4 alpha.

While it's not recommended, you can set an option in civicrm.settings.php to disable the IDS altogether: http://forum.civicrm.org/index.php?topic=12851.0

I also believe it's supposed to be disabled if you're in the Administrators CiviCRM group, but can't swear that's true.

Shawn_LaLucha · July 06, 2013, 02:12:02 pm

Thanks Jon! I appreciate the follow-up. I disabled it to get a few things done and will look for that fix in 4.4.

I appreciate the help greatly.

BasH · July 29, 2013, 04:49:47 am

I had the same problem after upgrading to CiviCRM 4.3.3. Couldn't update a contact (also couldn't use the cancel button, so even without changing something I got this error!). I am the administrator so it looks like that permission doesn't help either, maybe because I still use Drupal 6?.

I didn't completely remove the setting in the config file because that completely removes a security layer. Instead I used the solution suggested by Coleman Watts (see http://forum.civicrm.org/index.php/topic,18168.msg103823.html#msg103823) to change the ids.php file in the CRM/Core directory (only the linenumber changed to 185).

In my case there also was a workaround to be able to change a contact by hoovering over part of the contact in the contact view, in the upper right hand corner of this part an edit/add button appears and the contact can be changed without getting this error.

CiviCRM Community Forums (archive)

News:

Author Topic: Overactive IDS in 4.3.3 (Read 19615 times)

Shawn_LaLucha

Overactive IDS in 4.3.3

JonGold

Re: Overactive IDS in 4.3.3

Shawn_LaLucha

Re: Overactive IDS in 4.3.3

JonGold

Re: Overactive IDS in 4.3.3

Shawn_LaLucha

Re: Overactive IDS in 4.3.3

BasH

Re: Overactive IDS in 4.3.3