Hey there. So I’ve already reviewed the Github issue here, which has been closed in August since Cloudflare apparently made updates at that time, but I’m still unable to publish through Gutenberg and I’m getting the error that Cloudflare is blocking Rest API, and to disables the two rules: WP0025a and WP0025B. I’ve already disabled them prior, and I still can’t save a draft or whatever through Wordpress.
Interesting. I’m having Gutenberg issues on Safari, so I’ve been editing through Firefox and it’s working.
Are you getting any of these rules triggering? That’s a lot for just saving a post, unless I’ve got some kind of incorrect rule setup.
It’s actually really confusing as to why this hasn’t been solved yet and Github issued are marked fixed with updates. Like I’m not going in and playing test which rules to disable to allow Gutenberg to save a post lol. And I don’t want to disable rules that don’t need to be disabled either, but the two rules that could be disabled for a temporary fix don’t work anymore, and there’s literally 20+ rules triggering blocks, white listing the IP does nothing. I don’t really get why after whitelisting an IP Cloudflare is still issuing challenges or blocks. But yes totally I hope this is worked out as well because it’s getting to the point where I’m disabling web firewall to publish a post then putting it back up. I ain’t paying money to sacrifice security everytime I wanna make a post lol.
Allow me to add another “me to” on this issue. I was just checking to see if there were any known fixes on this issue on the Cloudflare side.
I. too, disabled the two rules that were supposed to fix this. For now, I get around this by white listing my IP, which only works temporarily, as I don’t have a static IP.
FWIW, below the rules that are matching in my case.
| 960024 | OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-ARGS:JSON_ARG_0005=. |
|---|---|
| 981231 | OWASP_CRS/WEB_ATTACK/SQL_INJECTION-ARGS:JSON_ARG_0005=“#post-2596”>More<br |
| 981318 | OWASP_CRS/WEB_ATTACK/SQL_INJECTION-2000000408_146=; |
| 950901 | OWASP_CRS/WEB_ATTACK/SQL_INJECTION-ARGS:JSON_ARG_0005=p>Brad |
| 981257 | DETECTS MYSQL COMMENT-/SPACE-OBFUSCATED INJECTIONS AND BACKTICK TERMINATION-OWASP_CRS/WEB_ATTACK/SQLI-2000000408_146=, they have a deeper purpose. Of course, the amount and depth of the message depends on the needs of your event. Some performances may not have any explicit message at all. Brad has a master |
| 981248 | DETECTS CHAINED SQL INJECTION ATTEMPTS 1/2-OWASP_CRS/WEB_ATTACK/SQLI-2000000408_146=div class=" |
| 981245 | DETECTS BASIC SQL AUTHENTICATION BYPASS ATTEMPTS 2/3-OWASP_CRS/WEB_ATTACK/SQLI-2000000408_146= has a |
| 981240 | DETECTS MYSQL COMMENTS, CONDITIONS AND CH(A)R INJECTIONS-OWASP_CRS/WEB_ATTACK/SQLI-2000000408_146="# |
| 981243 | DETECTS CLASSIC SQL INJECTION PROBINGS 2/2-OWASP_CRS/WEB_ATTACK/SQLI-2000000408_146=“><a href=”# |
| 973338 | OWASP_CRS/WEB_ATTACK/XSS-2000000412_204= xmlns: |
| 973300 | OWASP_CRS/WEB_ATTACK/XSS-ARGS:JSON_ARG_0005=<p> |
| 973304 | OWASP_CRS/WEB_ATTACK/XSS-2000000408_136=href= |
| 0= | |
| 1=( | |
| 2= | |
| 3= | |
| 4= | |
| 5= | |
| 6= | |
| 7= | |
| 973315 | OWASP_CRS/WEB_ATTACK/XSS-2000000412_217=<style> @keyframes paddingbounce { from {padding-top:5px; padding-bottom:15px;} to {padding-top:15px; padding-bottom:5px;} } @media only screen and ( |
| 973335 | OWASP_CRS/WEB_ATTACK/XSS-2000000412_217=“>Talk to us</a> about what we can do together.</p> <div class=“next-section”><a href=”#post-2596">More<br /><svg class=“icon icon-angle-down” aria-hidden=“true” role=“img”><use href=“#icon-angle-down” xmlns:xlink=“XLink namespace” xlink:href= |
| 973334 | OWASP_CRS/WEB_ATTACK/XSS-2000000412_217='s programs are amazing and funny, they have a deeper purpose. Of course, the amount and depth of the message depends on the needs of your event. Some performances may not have any explicit message at all. Brad has a master’s degree in Theology from Liber |
| 973333 | OWASP_CRS/WEB_ATTACK/XSS-2000000412_217=">Talk to us</a> about what we can do together.</p> <div class= |
| 960024 | OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-ARGS:JSON_ARG_0005 |
1 Like
This topic was automatically closed after 14 days. New replies are no longer allowed.