When you save changes on the user settings page (admin/user/settings) -- Drupal sends as "part" of the http request:

mail\x20
or
mail\\x20

(I can't say for sure which by reading my server logs but either one causes the problem below.)

This is a known "web attack", i.e. an attempt to get access to the mail command.

It is blocked by mod_security and other "security" software.

Is this intentional or just something that was not considered?

It is probably not serious, unless someone that really hates you, hacks your mail command and sends threats to our beloved president.... :-)

Keith

Comments

chx’s picture

chx commented
Priority: Normal » Minor
Status: Active » Closed (won't fix)

So there is a mail and a space. So what? This comes from "you will receive another e-mail containing information" but why is that a problem? Setting to won't fix until we get more information.

KeithDaniels’s picture

KeithDaniels commented

I have my own server and use mod_security (an apache module) to prevent spam and web attacks. When I upgraded to version 6 mod_security prevented anyone from saving any user changes and prevented me, as administrator, from assigining an account to someone. I removed the filter in mod_security so I have no problems.

Like I said, problaby not a big issue and I think the ability to hack the mail command or a mail server though using a space in the command has long been fixed.

I just wanted to make sure you knew about it.

Keith

flickerfly’s picture

flickerfly commented
Component: admin.module » base system

It might be helpful to understand why ModSecurity takes offense to this. Perhaps they have a point? What rule is it triggering? This should show up in your Apache error_log file.

forestmars’s picture

forestmars commented

I just remembered why posting to old threads is frowned up^H^Hon.