Theme Skinning Changes not Saved

[sayontan]

Did you try the suhosin-related fix suggested by Bird above?

[titus]

No, I didn't try yet but I checked and the value is:

suhosin.post.max_vars 300

I will ask the ISP to increase this to 500 and revert back to the forum.
Titus

[titus]

Changed it to 10.000 but it still doesn't save the settings.. Will try again in an hour or so.
This is what I put in my .htaccess file:

<IfModule mod_php.c>
php_value suhosin.post.max_vars 10000
php_value suhosin.request.max_vars 10000
php_value suhosin.get.max_vars 10000
</IfModule>

I checked with a phpinfo and it actually picks up the data.
Any other ideas?

Titus

[bird]

Well... there COULD be other variables messing around. Like "suhosin.post.max_value_length" and "suhosin.request.max_value_length" should be set to at least 30000.

In order to find the problem it might be helpful to post your other suhosin-variables. If you're lucky we'll be able to spot the malfunction... probably *shrug*

[sayontan]

As I mentioned, I have been working on a redesign. I have already finished separating all the theme skinning options out - hopefully we will see the end of this issue as soon as the release is out.

[titus]

hi bird,

attached the entire suhosin section of my phpinfo.

Well... there COULD be other variables messing around. Like "suhosin.post.max_value_length" and "suhosin.request.max_value_length" should be set to at least 30000.

You will see below that my values are 65.000 so that shouldn't be an issue.
Do you have any suggestion as to what else I should change? I am willing to guinea pig test this on my problem site as it's not a production site yet anyway...

Let me know your thoughts, thanks!
Titus


suhosin
This server is protected with the Suhosin Extension 0.9.27

Copyright (c) 2006-2007 Hardened-PHP Project
Copyright (c) 2007-2008 SektionEins GmbH


Directive Local Value Master Value
suhosin.apc_bug_workaround Off Off
suhosin.cookie.checkraddr 0 0
suhosin.cookie.cryptdocroot On On
suhosin.cookie.cryptkey [ protected ] [ protected ]
suhosin.cookie.cryptlist no value no value
suhosin.cookie.cryptraddr 0 0
suhosin.cookie.cryptua On On
suhosin.cookie.disallow_nul 1 1
suhosin.cookie.disallow_ws 1 1
suhosin.cookie.encrypt Off Off
suhosin.cookie.max_array_depth 50 50
suhosin.cookie.max_array_index_length 64 64
suhosin.cookie.max_name_length 64 64
suhosin.cookie.max_totalname_length 256 256
suhosin.cookie.max_value_length 10000 10000
suhosin.cookie.max_vars 100 100
suhosin.cookie.plainlist no value no value
suhosin.coredump Off Off
suhosin.disable.display_errors Off Off
suhosin.executor.allow_symlink Off Off
suhosin.executor.disable_emodifier Off Off
suhosin.executor.disable_eval Off Off
suhosin.executor.eval.blacklist no value no value
suhosin.executor.eval.whitelist no value no value
suhosin.executor.func.blacklist no value no value
suhosin.executor.func.whitelist no value no value
suhosin.executor.include.blacklist no value no value
suhosin.executor.include.max_traversal 0 0
suhosin.executor.include.whitelist no value no value
suhosin.executor.max_depth 0 0
suhosin.filter.action no value no value
suhosin.get.disallow_nul 1 1
suhosin.get.disallow_ws 0 0
suhosin.get.max_array_depth 50 50
suhosin.get.max_array_index_length 64 64
suhosin.get.max_name_length 64 64
suhosin.get.max_totalname_length 256 256
suhosin.get.max_value_length 512 512
suhosin.get.max_vars 200 200
suhosin.mail.protect 1 1
suhosin.memory_limit 128M 128M
suhosin.mt_srand.ignore On On
suhosin.multiheader Off Off
suhosin.perdir 0 0
suhosin.post.disallow_nul 1 1
suhosin.post.disallow_ws 0 0
suhosin.post.max_array_depth 50 50
suhosin.post.max_array_index_length 64 64
suhosin.post.max_name_length 64 64
suhosin.post.max_totalname_length 256 256
suhosin.post.max_value_length 65000 65000
suhosin.post.max_vars 10000 10000
suhosin.protectkey On On
suhosin.request.disallow_nul 1 1
suhosin.request.disallow_ws 0 0
suhosin.request.max_array_depth 50 50
suhosin.request.max_array_index_length 64 64
suhosin.request.max_totalname_length 256 256
suhosin.request.max_value_length 65000 65000
suhosin.request.max_varname_length 64 64
suhosin.request.max_vars 400 400
suhosin.server.encode On On
suhosin.server.strip On On
suhosin.session.checkraddr 0 0
suhosin.session.cryptdocroot On On
suhosin.session.cryptkey [ protected ] [ protected ]
suhosin.session.cryptraddr 0 0
suhosin.session.cryptua On On
suhosin.session.encrypt On On
suhosin.session.max_id_length 128 128
suhosin.simulation Off Off
suhosin.sql.bailout_on_error Off Off
suhosin.sql.comment 0 0
suhosin.sql.multiselect 0 0
suhosin.sql.opencomment 0 0
suhosin.sql.union 0 0
suhosin.sql.user_postfix no value no value
suhosin.sql.user_prefix no value no value
suhosin.srand.ignore On On
suhosin.stealth On On
suhosin.upload.disallow_binary 0 0
suhosin.upload.disallow_elf 1 1
suhosin.upload.max_uploads 10 10
suhosin.upload.remove_binary 0 0
suhosin.upload.verification_script no value no value

[titus]

I might have found another issue or actually a solution (thanks to the existence of error log files!!!)
This is what my error_log outputs when I try to save any modification to the skinning section of the theme:

[Wed Jan 05 09:57:40 2011] [error] [client XX.XX.65.248] ALERT - configured POST variable limit exceeded - dropped variable 'suf_navt_skin_settings_hl_border-right-border-width' (attacker 'XX.XX.65.248', file '/var/www/XXXXXXXXX/html/XXXXXXXXXXXX/kb/wp-admin/admin.php'), referer: http://www.XXXXXXXX.eu/kb/wp-admin/admi ... ffects.php
[Wed Jan 05 09:57:41 2011] [error] [client XX.XX.65.248] ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker 'XX.XX.65.248', file '/var/www/XXXXXXXXX/html/XXXXXXXXXXXX/kb/wp-admin/admin.php', line 96), referer: http://www.XXXXXXXX.eu/kb/wp-admin/admi ... ffects.php

Any suggestions on a quick fix? I have 128M on this machine allocated to that web site project and honestly don't want to increase that... ($$$).

Thanks, Titus

[titus]

Found the solution!

1.) the error of not being able to save the options selected in the skinning section of the suffusion theme were indeed related to suhosin limitations.

2.) with the suhosin settings below, everything is working now. The values in bold below helped to get the script working (and saving the options).

I hope this can be useful for anyone else in the future, until the new suffusion release!
All the best for now,
Titus


suhosin
This server is protected with the Suhosin Extension 0.9.27

Directive Local Value Master Value
suhosin.apc_bug_workaround Off Off
suhosin.cookie.checkraddr 0 0
suhosin.cookie.cryptdocroot On On
suhosin.cookie.cryptkey [ protected ] [ protected ]
suhosin.cookie.cryptlist no value no value
suhosin.cookie.cryptraddr 0 0
suhosin.cookie.cryptua On On
suhosin.cookie.disallow_nul 1 1
suhosin.cookie.disallow_ws 1 1
suhosin.cookie.encrypt Off Off
suhosin.cookie.max_array_depth 50 50
suhosin.cookie.max_array_index_length 64 64
suhosin.cookie.max_name_length 64 64
suhosin.cookie.max_totalname_length 256 256
suhosin.cookie.max_value_length 10000 10000
suhosin.cookie.max_vars 100 100
suhosin.cookie.plainlist no value no value
suhosin.coredump Off Off
suhosin.disable.display_errors Off Off
suhosin.executor.allow_symlink Off Off
suhosin.executor.disable_emodifier Off Off
suhosin.executor.disable_eval Off Off
suhosin.executor.eval.blacklist no value no value
suhosin.executor.eval.whitelist no value no value
suhosin.executor.func.blacklist no value no value
suhosin.executor.func.whitelist no value no value
suhosin.executor.include.blacklist no value no value
suhosin.executor.include.max_traversal 0 0
suhosin.executor.include.whitelist no value no value
suhosin.executor.max_depth 0 0
suhosin.filter.action no value no value
suhosin.get.disallow_nul 1 1
suhosin.get.disallow_ws 0 0
suhosin.get.max_array_depth 50 50
suhosin.get.max_array_index_length 64 64
suhosin.get.max_name_length 64 64
suhosin.get.max_totalname_length 256 256
suhosin.get.max_value_length 512 512
suhosin.get.max_vars 200 200
suhosin.mail.protect 1 1
suhosin.memory_limit 128M 128M
suhosin.mt_srand.ignore On On
suhosin.multiheader Off Off
suhosin.perdir 0 0
suhosin.post.disallow_nul 1 1
suhosin.post.disallow_ws 0 0
suhosin.post.max_array_depth 50 50
suhosin.post.max_array_index_length 64 64
suhosin.post.max_name_length 64 64
suhosin.post.max_totalname_length 256 256
suhosin.post.max_value_length 65000 65000
suhosin.post.max_vars 10000 10000
suhosin.protectkey On On
suhosin.request.disallow_nul 1 1
suhosin.request.disallow_ws 0 0
suhosin.request.max_array_depth 50 50
suhosin.request.max_array_index_length 64 64
suhosin.request.max_totalname_length 256 256
suhosin.request.max_value_length 65000 65000
suhosin.request.max_varname_length 64 64
suhosin.request.max_vars 5000 5000
suhosin.server.encode On On
suhosin.server.strip On On
suhosin.session.checkraddr 0 0
suhosin.session.cryptdocroot On On
suhosin.session.cryptkey [ protected ] [ protected ]
suhosin.session.cryptraddr 0 0
suhosin.session.cryptua On On
suhosin.session.encrypt On On
suhosin.session.max_id_length 128 128
suhosin.simulation Off Off
suhosin.sql.bailout_on_error Off Off
suhosin.sql.comment 0 0
suhosin.sql.multiselect 0 0
suhosin.sql.opencomment 0 0
suhosin.sql.union 0 0
suhosin.sql.user_postfix no value no value
suhosin.sql.user_prefix no value no value
suhosin.srand.ignore On On
suhosin.stealth On On
suhosin.upload.disallow_binary 0 0
suhosin.upload.disallow_elf 1 1
suhosin.upload.max_uploads 10 10
suhosin.upload.remove_binary 0 0
suhosin.upload.verification_script no value no value

[Firefig]

I've got the same problem, only I can't change options. These are my steps:
Select Theme Skinning
Change to Custom styles
Hit the "save change on this page button" (yes I see it)
In fact, the changes do not happen and the browser jumps to spy phone the previous page that I happened to edit in the Visual Effects before I selected Theme Skinning.

[sayontan]

I've got the same problem, only I can't change options. These are my steps:
Select Theme Skinning
Change to Custom styles
Hit the "save change on this page button" (yes I see it)
In fact, the changes do not happen and the browser jumps to the previous page that I happened to edit in the Visual Effects before I selected Theme Skinning.

Your problem is different - you have a plugin whose JS is conflicting with Suffusion's.