Formidable Pro – WordPress Forms

[Andre]

MMh, I am also getting ugly security logs on using the admin panel of formidablepro, when I am using the settings page of the plugin

Like this:

>>>>>>>>>>> 403 GET or Other Request Error Logged - May 31, 2013 - 12:39 am <<<<<<<<<<<
REMOTE_ADDR: my IP
Host Name: my-host
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER: http: //www.my-domain.com/wp-admin/admin.php?page=formidable-settings
REQUEST_URI: /wp-admin/index.php?plugin=formidable&controller=settings&frm_action=process-form&action=process-form&_wpnonce=8d9bd2bea3&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dformidable-settings&frm_menu=Formidable&frm-preview-page-id=&frm_load_style=all&frm_use_html=1&frm_view_forms=administrator&frm_edit_forms=administrator&frm_delete_forms=administrator&frm_change_settings=administrator&frm_view_entries=administrator&frm_create_entries=administrator&frm_edit_entries=administrator&frm_delete_entries=administrator&frm_view_reports=administrator&frm_edit_displays=administrator&frm_pubkey=&frm_privkey=&frm_re_theme=red&frm_re_lang=en&frm_blank_msg=This+field+cannot+be+blank.&frm_invalid_msg=There+was+a+problem+with+your+submission.+Errors+are+marked+below.&frm_unique_msg=This+value+must+be+unique.&frm_success_msg=Thank+you+for+your+entry.+The+information+you+provided+is+subject+to+review+and+will+be+available+on+this+site+shortly.&frm_failed_msg=We%27re+sorry.+It+looks+like+you%27ve++already+submitted+that.&frm_login_msg=You+do+not+have+permission+to+view+this+form.&frm_submit_value=Submit&frm_already_submitted=You+have+already+submitted+that+form&frm_template_path=&frm_date_format=m%2Fd%2FY&frm_csv_format=UTF-8&frm_permalinks=0&frm_form_align=left&frm_form_width=700px&frm_fieldset=0px&frm_fieldset_color=000000&frm_fieldset_padding=0px&frm_font=%22Lucida+Grande%22%2C%22Lucida+Sans+Unicode%22%2CTahoma%2Csans-serif&frm_label_color=444444&frm_weight=bold&frm_font_size=12px&frm_position=none&frm_align=left&frm_width=150px&frm_required_color=ff0000&frm_required_weight=bold&frm_description_font=%22Lucida+Grande%22%2C%22Lucida+Sans+Unicode%22%2CTahoma%2Csans-serif&frm_description_color=666666&frm_description_weight=normal&frm_description_style=normal&frm_description_font_size=11px&frm_description_align=left&frm_border_radius=0px&frm_field_font_size=13px&frm_field_width=100%25&frm_field_pad=2px&frm_field_margin=20px&frm_bg_color=eeeeee&frm_text_color=444444&frm_border_color=dddddd&frm_field_border_width=1px&frm_field_border_style=solid&frm_bg_color_active=ffffff&frm_border_color_active=dddddd&frm_bg_color_error=eeeeee&frm_text_color_error=444444&frm_border_color_error=ff0000&frm_border_width_error=1px&frm_border_style_error=solid&frm_radio_align=block&frm_check_align=block&frm_check_font=%22Lucida+Grande%22%2C%22Lucida+Sans+Unicode%22%2CTahoma%2Csans-serif&frm_check_label_color=444444&frm_check_weight=normal&frm_check_font_size=12px&frm_theme_selector=ui-lightness&frm_theme_css=ui-lightness&frm_theme_name=UI+Lightness&frm_submit_style=1&frm_submit_weight=normal&frm_submit_border_radius=11px&frm_submit_font_size=14px&frm_submit_width=auto&frm_submit_height=auto&frm_submit_bg_color=eeeeee&frm_submit_bg_color2=cccccc&frm_submit_text_color=444444&frm_submit_bg_img=&frm_submit_border_color=dddddd&frm_submit_border_width=1px&frm_submit_shadow_color=999999&frm_submit_margin=0px&frm_submit_padding=3px+8px&frm_error_bg=B81900&frm_error_border=be2e17&frm_error_text=ffffff&frm_error_icon=http%3A%2F%2Fwww.my-domain.com%2Fwp-content%2Fplugins%2Fformidable%2Fpro%2Fimages%2Ferror_icons%2Fupdate.png&frm_error_font_size=14px&frm_success_bg_color=FFFFE0&frm_success_border_color=E6DB55&frm_success_text_color=444444&frm_success_font_size=14px&frm_custom_css=
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36

[AITpro Admin]

UPDATE: BPS Pro 13+ and BPS 2.0+ versions have a feature called: Setup Wizard AutoFix (AutoWhitelist|AutoSetup|AutoCleanup) that automatically creates plugin and theme whitelist rules and automatically sets up and cleans up caching plugins htaccess code.

Yes, I have seen this before and I must say that that is the ugliest query string I have ever seen in a plugin in my life.  😉  I know I have already answered this issue somewhere else in the Forum, but it appears the Tags for that Forum Topic were deleted so I cannot find that Topic so I will answer it again.

Logically this should work.

Add this wp-admin .htaccess bypass / skip rule below to the wp-admin Custom Code box – CUSTOM CODE WPADMIN PLUGIN FIXES: and then activate BulletProof Mode for your wp-admin folder again.   The skip rule must be [S=3] because it will be written to your wp-admin .htaccess file above skip / bypass rule [S=2] for your bbPress post.php skip/bypass rule. This bypass / skip rule is safe to use because the wp-admin area is protected with WP Authentication security.  Add this skip/bypass rule above your BuddyPress post.php skip/bypass rule.

# Formidable Pro query string wp-admin skip rule
RewriteCond %{QUERY_STRING} plugin=formidable&controller=settings(.*) [NC]
RewriteRule . - [S=3]

[Andre]

Yap. I supposed that You have answered already, but didnt find anything either. And yes, You are right, that You made a seperate topic out of it. me lazy… 😉

And the skip rule is S3

But… for such an ugly error it is okay to mess things up! Kidding… 🙂

But the tool is too cool in usage. I swear my life on this form plugin.

[Andre]

BTW, You-re the best!

 

WORX!!!

[AITpro Admin]

Cool!  Yep, BuddyPress and bbPress make it super easy to Split, Merge or Move Topics with only one click so no big deal about posting in the same topic.  The main thing is that I want to be able to find things again when I go looking for them so I’m not answering the same questions again.

Also the Formidable plugin has a couple of js plugin scripts that need to be whitelisted in the Plugin Firewall, which I assume you have already done.

[Andre]

Mmh. A couple might be exxagerated. This is what I have found out with You together, and what I saved as text to whitelist in the future always:

/formidable/js/formidable.js, /formidable/pro/js/(.*).js,

[Andre]

Hi,
on another site probably I got the same sec log again.
Can I add the same bypass rule?
Sec log:

>>>>>>>>>>> 403 GET or HEAD Request Error Logged - 25. September 2013 - 13:07 <<<<<<<<<<<
REMOTE_ADDR: 87.141.28.171
Host Name: p578D1CAB.dip0.t-ipconnect.de
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: http: //www.mydomain.com/wp-admin/admin.php?page=formidable-settings
REQUEST_URI: /wp-admin/index.php?plugin=formidable&controller=settings&frm_action=process-form&action=process-form&_wpnonce=6b6ef1c65d&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dformidable-settings&frm_menu=Formidable&frm-preview-page-id=&frm_load_style=all&frm_use_html=1&frm_view_forms=administrator&frm_edit_forms=administrator&frm_delete_forms=administrator&frm_change_settings=administrator&frm_view_entries=administrator&frm_create_entries=administrator&frm_edit_entries=administrator&frm_delete_entries=administrator&frm_view_reports=administrator&frm_edit_displays=administrator&frm_pubkey=6LfBH8oSAAAAAHRsUFIfuGPMjbP5TUYzPGtIA4Wv&frm_privkey=6LfBH8oSAAAAAPOT1RWlDltRBExyoA-znKbuzdCf&frm_re_theme=white&frm_re_lang=de&frm_blank_msg=Dies+Feld+darf+nicht+leer+bleiben.&frm_invalid_msg=Es+gab+ein+Problem+mit+Ihrer+Eingabe.+Die+Fehler+sind+deutlich+vermerkt.&frm_unique_msg=This+value+must+be+unique.&frm_success_msg=Ihre+Mitteilung+wurde+erfolgreich+%C3%BCbermittelt.+Vielen+Dank!&frm_failed_msg=Entschuldigung.+Es+scheint%2C+als+h%C3%A4tten+Sie+das+bereits+abgesendet.&frm_login_msg=Sie+haben+keine+Berechtigung+dieses+Formular+zu+sehen.&frm_submit_value=Senden&frm_already_submitted=Dieses+Formular+haben+Sie+bereits+ausgef%C3%BCllt&frm_template_path=&frm_date_format=m%2Fd%2FY&frm_csv_format=UTF-8&frm_permalinks=0&frm_form_align=left&frm_form_width=100%25&frm_fieldset=0px&frm_fieldset_color=000000&frm_fieldset_padding=0px&frm_font=%22Arial%22%2C%22Lucida+Grande%22%2C%22Lucida+Sans+Unicode%22%2CTahoma%2Csans-serif&frm_label_color=5c5c5c&frm_weight=bold&frm_font_size=12px&frm_position=none&frm_align=left&frm_width=150px&frm_required_color=ff0000&frm_required_weight=bold&frm_description_font=%22Arial%22%2C%22Lucida+Grande%22%2C%22Lucida+Sans+Unicode%22%2CTahoma%2Csans-serif&frm_description_color=5c5c5c&frm_description_weight=normal&frm_description_style=normal&frm_description_font_size=13px&frm_description_align=left&frm_border_radius=0px&frm_field_font_size=14px&frm_field_width=100%25&frm_field_pad=2px&frm_field_margin=20px&frm_bg_color=eeeeee&frm_text_color=444444&frm_border_color=dddddd&frm_field_border_width=1px&frm_field_border_style=solid&frm_bg_color_active=85a791&frm_border_color_active=dddddd&frm_bg_color_error=eeeeee&frm_text_color_error=444444&frm_border_color_error=ff0000&frm_border_width_error=1px&frm_border_style_error=solid&frm_radio_align=block&frm_check_align=block&frm_check_font=%5C%22Arial%5C%22%2C%5C%22Lucida+Grande%5C%22%2C%5C%22Lucida+Sans+Unicode%5C%22%2CTahoma%2Csans-serif&frm_check_label_color=5c5c5c&frm_check_weight=normal&frm_check_font_size=12px&frm_theme_selector=smoothness&frm_theme_css=smoothness&frm_theme_name=Smoothness&frm_submit_style=1&frm_submit_weight=normal&frm_submit_border_radius=11px&frm_submit_font_size=14px&frm_submit_width=auto&frm_submit_height=auto&frm_submit_bg_color=21924a&frm_submit_bg_color2=21924a&frm_submit_text_color=5c5c5c&frm_submit_bg_img=&frm_submit_border_color=dddddd&frm_submit_border_width=1px&frm_submit_shadow_color=999999&frm_submit_margin=0px&frm_submit_padding=3px+8px&frm_error_bg=B81900&frm_error_border=be2e17&frm_error_text=ffffff&frm_error_icon=http%3A%2F%2Fwww.mydomain.com%2Fwp-content%2Fplugins%2Fformidable%2Fpro%2Fimages%2Ferror_icons%2Fupdate.png&frm_error_font_size=14px&frm_success_bg_color=85a791&frm_success_border_color=e3e3e3&frm_success_text_color=444444&frm_success_font_size=14px&frm_custom_css=
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36

add this to bypass?

# Formidable Pro query string wp-admin skip rule
RewriteCond %{QUERY_STRING} plugin=formidable&controller=settings(.*) [NC]
RewriteRule . - [S=3]

[AITpro Admin]

Yep

[Andre]

thanks
BTW, the code also scares me….
I am thinking about switching to another form plugin with similar functionality on the user / developer site….
Gravity seems too expensive. Ninja is nice probably but the best things are only available over expensive addons.
In the end the functionality paired with the price was the main decision why to go with formidablepro.
But now, they have added a sick support option without asking people and being unfair to the already registered users.
I consider them kind of arrogant (whil most of the time being polite) and so … didnt like their support (had to repeat written requests soooo often, while it was just using different words and the request MUST have been clear already on first post, when read thoroughly) so , I wouldnt like to pay for this kind of support anyway…
Any ideas?

[Andre]

Sorry, only thing is :
You write that the bypass should be [S3].
But there we talked about another site.
In the site where I want to add it, I got no other skip / bypass rule, in the end no custom code at all.
Should I write:

# Formidable Pro query string wp-admin skip rule
RewriteCond %{QUERY_STRING} plugin=formidable&controller=settings(.*) [NC]
RewriteRule . - [S=2]

or even:

# Formidable Pro query string wp-admin skip rule
RewriteCond %{QUERY_STRING} plugin=formidable&controller=settings(.*) [NC]
RewriteRule . - [S=1]

?

[AITpro Admin]

Skip rules work like this:

S=1 means skip 1 RewriteRule.  S=2 means skip 2 RewriteRules.  Skip rules MUST go in descending order with the largest/highest skip rule first in descending order.  So if you only have S=1 in your wp-admin .htaccess file then the next skip rule would be S=2.  If you already have an S=2 skip rule then the next skip rule is S=3, etc etc etc.

S=20
S=19
…
…
…
S=3
S=2
S=1

[Andre]

Okay, I have NO other custom code, thats why I go with S1…

[AITpro Admin]

The wp-admin .htaccess file comes with a standard/default S=1 skip rule for the press-this.php file already so usually when you add an additional skip rule to Custom Code that skip rule will be an S=2 skip rule.

This is the default/standard S=1 skip rule that is already in the wp-admin .htaccess file.

# Fix for WP Press This
RewriteCond %{REQUEST_URI} (press-this\.php) [NC]
RewriteRule . - [S=1]

[Andre]

thanks again

[Author]

Posts