Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

permanent block, suhosin #2605

Closed
anonymous-matomo-user opened this issue Aug 1, 2011 · 8 comments
Closed

permanent block, suhosin #2605

anonymous-matomo-user opened this issue Aug 1, 2011 · 8 comments
Labels
Bug For errors / faults / flaws / inconsistencies etc. Major Indicates the severity or impact or benefit of an issue is much higher than normal but not critical. worksforme The issue cannot be reproduced and things work as intended.
Milestone
1.x

Comments

@anonymous-matomo-user
Copy link

These log entries appear approx. 10-20 daily:

Jul 26 08:55:04 orange suhosin[5942]: ALERT - configured GET variable value length limit exceeded - dropped variable 'urlref' (attacker '175.145.217.174', file '/home/public_html/piwik/piwik.php')

Jul 26 08:55:04 orange suhosin[5942]: ALERT - configured GET variable value length limit exceeded - dropped variable '_ref' (attacker '175.145.217.174', file '/home/public_html/piwik/piwik.php')

Jul 26 08:55:12 orange suhosin[6186]: ALERT - configured GET variable value length limit exceeded - dropped variable '_ref' (attacker '175.145.217.174', file '/home/public_html/piwik/piwik.php')

Jul 26 08:55:28 orange suhosin[6304]: ALERT - configured GET variable value length limit exceeded - dropped variable '_ref' (attacker '175.145.217.174', file '/home/public_html/piwik/piwik.php')

Jul 26 08:55:51 orange suhosin[6454]: ALERT - configured GET variable value length limit exceeded - dropped variable '_ref' (attacker '175.145.217.174', file '/home/public_html/piwik/piw
Keywords: suhosin
@peterbo
Copy link
Contributor

peterbo commented Aug 1, 2011

please change the request method of the tracker to "POST":

piwikTracker.setRequestMethod( "POST");

@anonymous-matomo-user
Copy link
Author

I'm getting this error in logs.

Is it an attack situation? oris suhosin alert triggered by a "normal" piwik page?

@robocoder
Copy link
Contributor

It depends on your suhosin configuration and the referrer url.

If you want to see if its malicious or not, try switching to POST or examining your Apache logs.

@anonymous-matomo-user
Copy link
Author

where do I switch to post?

@anonymous-matomo-user
Copy link
Author

Getting the same error. Where do I switch to "post"?

@mattab
Copy link
Member

mattab commented Jun 19, 2012

you can call in the JS tracker piwikTracker.setRequestMethod( 'POST' );

it will work only if the piwik server is on the smae domain as the website being tracked

@anonymous-matomo-user
Copy link
Author

Piwik and website domains are different. But I now understand that this is not a Piwik problem, but caused by a very long referrer that is stored in "_ref" so Suhosin would have to be adapted.

Is this assumption correct?

@mattab
Copy link
Member

mattab commented Jul 19, 2012

please disalbe suhosin for Piwik requests

@anonymous-matomo-user anonymous-matomo-user added this to the 1.x - Piwik 1.x milestone Jul 8, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug For errors / faults / flaws / inconsistencies etc. Major Indicates the severity or impact or benefit of an issue is much higher than normal but not critical. worksforme The issue cannot be reproduced and things work as intended.
Projects
None yet
Milestone
1.x
Development

No branches or pull requests
4 participants
@mattab @robocoder @peterbo @anonymous-matomo-user