modsecurity prevents WP Githuber MD from working

[gene1wood]

(see also coreruleset/wordpress-rule-exclusions-plugin#60 )

Describe the bug

The modsecurity web application firewall (WAF) which is often used in Apache and Nginx, prevents WP Githuber MD from working because it triggers a false positive due to the h2m_strip_tags argument.

The WAF see's the argument which contains the string strip_tags and thinks it's a PHP Injection Attack.

I'm reporting this, not necessarily because something should be changed/fixed in WP Githuber MD, maybe just to add it to the known issues.

To reproduce

Steps to reproduce the behavior:

1. Install modsecurity and modsecurity-crs
2. Install the wordpress-rule-exclusions-plugin for crs
3. Update a Wordpress page

Expected behavior

Ideally modsecurity wouldn't block the POST and would allow the user to post pages using WP Githuber MD

Server environment

• WordPress version 6.6.1
• WP Githuber MD plugin version 1.16.3
• PHP version 8.3

User environment

• OS: Linux
• Browser Firefox

Additional context

Logs can be seen in the issue opened with the wordpress-rule-exclusions-plugin modsecurity CRS plugin coreruleset/wordpress-rule-exclusions-plugin#60

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 2 days.

[gene1wood]

This issue is still valid, we should keep it open.

[Evil0ctal]

[Evil0ctal]

This plugin is likely no longer actively maintained. My WAF suggested that I delete it since it has been removed from the plugin marketplace. However, I have used it frequently over the past two years. Although I don’t know the reason behind the discontinuation of its maintenance, I appreciate the developer’s work on it.

[gene1wood]

I don't think it's been removed from the plugin marketplace. I think it's just been temporarily disabled

The Wordpress plugin page

https://wordpress.org/plugins/wp-githuber-md/

says

This plugin has been closed as of October 8, 2024 and is not available for download. This closure is temporary, pending a full review.

@terrylinooo Do you know what their issue with your plugin is?