Drupal 6.26, Drupal Tiny-IDS 6.x-1.0-alpha1
Wysiwyg 6.x-2.4, tinymce_3.4.7

Hello Patrick,

Editing (and updating) content while tiny-IDS is active (with default settings) produces warnings. The typical error log entry looks like this :

========================================
Home » Administer » Reports
Details
Type tinyids
Date Wednesday, 30 May, 2012 - 17:48
User MyUserName
Location http://edusat.org/fr/node/349/edit
Referrer http://edusat.org/fr/node/349/edit
Message The following intrusions were detected:
$_POST['body']
Valeur

(Rédaction terminée - à corriger et mettre en page.
*** much text deleted here, included links to local images, nothing uncommon ***
Murakoze - muito obrigado !

Impact 20 / 10
Findings xss, csrf Possibly malicious html element including some attributes. 5
sqli Basic SQL authentication bypass attempt. 4
rce Specific directory and path traversal. 3
xss Obfuscated script tags or XML wrapped HTML. 3
xss URL injection, VBS injection or common URI scheme. 3
xss, csrf HTML breaking injections including whitespace attacks. 2
Severity warning
Hostname 92.104.64.107
Operations
========================================

I have been creating content at the time, wearing no hat at all ;) (neither black nor white) and I am surprised tiny-IDS should complain.

What do you think ?

Kind regards.

-rg-

Comments

patrickd’s picture

Category: bug » support

Hi!

Well such false positives are a typical problem of web intrusion detection systems.

It's hard to recognize whether the user putting html into a node is a good or bad boy.

You can either raise the sensibility of tinyids, or give trusted users who can edit content containing HTML the permission to bypass tinyids (recommended).

thanks for using,

regards

dimmie’s picture

Hi Patrick,

Thanks - I'll add the editing users to tiniy_IDS setup.

-rg-

patrickd’s picture

Status: Active » Fixed

okay, feel free to reopen if you encounter any other problems!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.