1

One of my clients sends emails with click-through links. And sometimes, after clicking on the link, the following message is displayed.enter image description here

I did some research. The error is generated from a piece of code that does an IDS check. IDS stands for Intruder Detection System. It can be disabled in Drupal 7 by granting the skip IDS check to the anonymous user.

enter image description here

Now I have a workaround, but comment of the grants says this permission has security implications

What are exactly this security implications? Clients are always reluctant in disabling security stuff.

The work for IDS is done by the PHP package PHPIDS. It can be found on GitHub https://github.com/PHPIDS/PHPIDS. I could not find any documentation about how it works. The stats show me the following.

  • The project is a bit old. Last commit in 2014.
  • The project was also popular - 224 forks.

So maybe the IDS solves a problem from a long time ago and is not needed any more. Does someone (with a good memory) know the answers?

Improve this question

1 Answer 1

Reset to default
1

It still has a use and does catch some attacks, but it does sometimes give false positives for civi (e.g. copy/pasting a long email thread into an activity is the one I usually see), and yes is very old. Some firewalls have traffic analysis that can be an alternative, or if you have access you could install an alternative IDS like Snort.

Improve this answer
1
  • The good thing about Snort is that it has documentation
    – Kainuk - CiviCooP
    May 16 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.