I've been through the “seven layers of the candy cane forest” on this one… :)
Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd behavior. In one specific scenario, the POST requests were erroneously generating a 404 (Not Found) error.
I started very broad and narrowed the problem down bit by bit by bit until I was left with the following reproduction scenario. The puzzling error occurs for:
- Any “POST" request
- to any URL at or below http://example.com/wp-content/
- that provides x-www-form-urlencoded data
or("or" followed by a space; not case sensitive) followed immediately by a number anywhere in the submitted data (not just field values) (e.g.
an ARM or 30-year fixed-rate mortgage)
I checked the other installed plugins. Nothing. I checked the templates. Nada. I checked a few other sites with our plugin installed but still couldn't reproduce the bug.
From everything I can tell, this is an incredibly specific problem on the single site in question. Due to the reproduction scenario, I'm guessing it's due to some overambitious anti-SQL injection code.
Is there any code present by default in Wordpress that could be causing this problem? My guess is that this problem is to blame on something else (e.g. a firewall, a
.htaccess rule, etc), but I thought I'd check with the experts! :)
We've also observed this issue with a post data in the format "[operator] having [string]", such as
< having x,
or having y,
and having z, etc. Given that
HAVING is an SQL keyword, I suspect this is further evidence of a poorly configured security tool. Note that these various observations were made on different servers, so it's not just something funky on this single server. I guess multiple servers could be misconfigured/have strict security protocols in place, though...
I've run into this issue again. This time, I've simplified the problem POST payload to simply the string
<strong>. Any POSTed data that includes this string (in-line with the other conditions above) generates a 404.