CiviCRM Community Forums (archive)

On civi 4.4.5 and MYSQL 5.5
In the last few days two of my people got locked out, their browsers just hung. It turned out they were blocked when Cpanel got the following error

[Wed Jun 11 03:15:51 2014] [error] [client 68.x.y.229] ModSecurity: Access denied with code 500 (phase 2). Pattern match "((alter|create|drop)[[:space:]]+(column|database|procedure|table)|delete[[:space:]]+from|update.+set.+=)" at ARGS:entryURL. [file "/usr/local/apache/conf/modsec2.user.conf"] [line "368"] [id "300015"] [rev "1"] [msg "Generic SQL injection protection"] [severity "CRITICAL"] [hostname "xyz.org"] [uri "/civicrm/contact/view/rel"] [unique_id "z"]

I believe the users were trying to delete a relationship

The last entry in the Watchdog log is

Notice: Undefined index: 62_ in CRM_Contact_Form_Relationship->setDefaultValues() (line 218 of /home/xyzprod/public_html/sites/all/modules/civicrm/CRM/Contact/Form/Relationship.php).

I don't think the messages are related. Working through the issue of something thinking a normal request is a security issue.

Hershel, thanks for your suggestion. 

My ISP updated modsecurity.  Fixed it and also the failure I was seeing in updating relationships. I made changes to Civi, Mysql, PHP and Drupal. Unclear which update created the issue.