problem with members permissions

Hi TinyBinary. Sorry for the trouble. Could you take a look at your network inspector and see if the JavaScript combo loader requests completed successfully? If they errored with a 403 error and you have mod_security enabled, try relaxing the rule that restricts long query strings.

I saw that these two URLS cannot load (failed)

admin.php?S=0&D=cp&C=javascript&M=combo_load&ui=core,widget,mouse,position,sortable,dialog,button&plugin=ee_interact.event,ee_broadcast.event,ee_notice,ee_txtarea,tablesorter,ee_toggle_all,nestable&file=react/react.min,react/react-dom.min,json2,underscore,cp/global_start,cp/form_validation,cp/sort_helper,cp/form_group,cp/modal_form,cp/confirm_remove,cp/fuzzy_filters,components/no_results,components/loading,components/filters,components/filterable,components/toggle,components/select_list,fields/select/select,fields/select/mutable_select,fields/dropdown/dropdown&v=1550887593

admin.php?S=0&D=cp&C=javascript&M=combo_load&file=cp/global_end&v=1550887390

As it’s a linux cluster, I do not have possibilities to change mod_security rules.

For guests users, it’s a 404 error.

Two things I’m observing…. that are unusual

when I go to members guests permissions, a lot of settings are stuck in loading….

when I go to template routes, I cannot add routing conditions. Nothing happens when I push add.

Yes those are all symptoms of not having JavaScript in the control panel. So the combo loader requests returned 403? If so, the only way to get around it is to relax mod_security.

FWIW, mod_security’s filters should be whitelisted from your control panel URLs. It’s fine to keep the request-based rules to help prevent DDOS and so forth, but regular use of and administrative panel of a content management system is going to regularly trip common mod_security rules, because if the same requests were being made from an unauthenticated visitor to the front end of your site, it would be quite suspicious.

I checked and mod_security is disabled. In the server setting, I see http.firewall=none (= mod security disabled) I even added that to .htaccess <IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule> AcceptPathInfo On

Here my .htaccesss

<IfModule mod_rewrite.c> RewriteEngine On RewriteBase /ee/

# Removes index.php from ExpressionEngine URLs
RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
RewriteCond %{REQUEST_URI} !/system/.* [NC]
RewriteRule (.*?)index\.php/*(.*) $1$2 [R=301,NE,L]

# Directs all EE web requests through the site index file
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

</IfModule> <IfModule mod_security.c> SecFilterEngine Off SecFilterScanPOST Off </IfModule> AcceptPathInfo On

Messages of the console when I try to create a new route

Have you tried another browser? That ERR_SPDY_PROTOCOL_ERROR 200 error seems to only come up in Chrome. Here’s some more info:

https://www.itechgyan.com/err_spdy_protocol_error/

If that doesn’t work, try Googling the error as I have, there’s a lot of talk around this and ways to fix your browser.

Yes, with another browser, the error is just different. It’s the first time that I have it on a server.

Loading failed for the [removed] with source “https://www.aoflyingcar.com/ee/admin.php?S=0&D=cp&C=javascript&M=combo_load&file=cp/global_end&v=1550887390”. admin.php:533:1 TypeError: $(…).toggleCodeMirror is not a function[Learn More] admin.php:536:38

<a> https://www.aoflyingcar.com/ee/admin.php?/cp/design/template/edit/1:536 l4jQuery

Loading failed for the [removed] with source “https://www.aoflyingcar.com/ee/admin.php?S=0&D=cp&C=javascript&M=combo_load&ui=core,widget,mouse,position,sortable,dialog,button&plugin=ee_interact.event,ee_broadcast.event,ee_notice,ee_txtarea,tablesorter,ee_toggle_all,nestable&file=react/react.min,react/react-dom.min,json2,underscore,cp/global_start,cp/form_validation,cp/sort_helper,cp/form_group,cp/modal_form,cp/confirm_remove,cp/fuzzy_filters,components/no_results,components/loading,components/filters,components/filterable,components/toggle,components/select_list,fields/select/select,fields/select/mutable_select,fields/dropdown/dropdown&v=1550887593”. admin.php:533:1 Loading failed for the [removed] with source “https://www.aoflyingcar.com/ee/admin.php?S=0&D=cp&C=javascript&M=combo_load&ui=resizable&plugin=ee_codemirror&file=codemirror/codemirror,codemirror/closebrackets,codemirror/lint,codemirror/overlay,codemirror/xml,codemirror/css,codemirror/javascript,codemirror/htmlmixed,codemirror/ee-mode,codemirror/dialog,codemirror/searchcursor,codemirror/search&v=1550887576”. admin.php:533:1 Loading failed for the [removed] with source “https://www.aoflyingcar.com/ee/admin.php?S=0&D=cp&C=javascript&M=combo_load&file=cp/global_end&v=1550887390”.

Basically I think it’s Javascript not working as for example

• there is no coloring for the template editor

• the button to update from 5.12 to 5.1.3 do nothing.

what can block Javascript on the admin console.

Also I still do not understand why templates cannot be seen by guests.

That’s what Kevin’s been saying this whole time; the problems are because your server is either not loading the resources, or your browser is blocking them. Templates would not be visible by anyone if your site’s JavaScript won’t load, because those settings use JavaScript. When you save them in a broken state, you’re submitting values that don’t reflect what you want.

FWIW, I can copy and paste those combo loader URLs into my browser and I access them fine. What all browsers have you tried, and have you disabled all of your browser plugins/extensions? This doesn’t appear to be server or application related since I can access them fine here.

It’s a server problem, this is my guessing.