Broken Adobe CQ page rendering - adobe

I am trying to get page (CQ 5.4):
htttp://localhost:4502/etc/replication/agents.author.html
But see the next:
Resource dumped by HtmlRendererServlet
Resource path: /etc/replication/agents.author
Resource metadata: {sling.resolutionPathInfo=.html, sling.resolutionPath=/etc/replication/agents.author}
Resource type: cq:Page
Resource super type: -
Resource properties..
In the 'system/console' > 'Recent requests' we can see render process.
0 (2013-12-16 02:33:09) TIMER_START{Request Processing}
0 (2013-12-16 02:33:09) COMMENT timer_end format is {<elapsed msec>,<timer name>} <optional message>
0 (2013-12-16 02:33:09) LOG Method=GET, PathInfo=/etc/replication/agents.author.html
0 (2013-12-16 02:33:09) TIMER_START{ResourceResolution}
1 (2013-12-16 02:33:09) TIMER_END{1,ResourceResolution} URI=/etc/replication/agents.author.html resolves to Resource=JcrNodeResource, type=cq:Page, superType=null, path=/etc/replication/agents.author
1 (2013-12-16 02:33:09) LOG Resource Path Info: SlingRequestPathInfo: path='/etc/replication/agents.author', selectorString='null', extension='html', suffix='null'
1 (2013-12-16 02:33:09) TIMER_START{ServletResolution}
1 (2013-12-16 02:33:09) TIMER_START{resolveServlet(JcrNodeResource, type=cq:Page, superType=null, path=/etc/replication/agents.author)}
1 (2013-12-16 02:33:09) TIMER_END{0,resolveServlet(JcrNodeResource, type=cq:Page, superType=null, path=/etc/replication/agents.author)} Using servlet org.apache.sling.servlets.get.DefaultGetServlet
1 (2013-12-16 02:33:09) TIMER_END{0,ServletResolution} URI=/etc/replication/agents.author.html handled by Servlet=org.apache.sling.servlets.get.DefaultGetServlet
1 (2013-12-16 02:33:09) LOG Applying Requestfilters
Used DefaultGetServlet instead of Page.jsp (Using servlet org.apache.sling.servlets.get.DefaultGetServlet)
All bundles are active.
Log outputs:
==> request.log <==
17/Dec/2013:01:29:49 -0800 [3677] -> GET /etc/replication/agents.author.html HTTP/1.1
17/Dec/2013:01:29:49 -0800 [3677] <- 200 text/html 3ms
==> access.log <==
<myIp> - admin 17/Dec/2013:01:29:49 -0800 "GET /etc/replication/agents.author.html HTTP/1.1" 200 1232 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36"
==> request.log <==
17/Dec/2013:01:29:50 -0800 [3678] -> GET /favicon.ico HTTP/1.1
==> error.log <==
17.12.2013 01:29:50.332 *INFO* [82.209.214.162 [1387272590327] GET /favicon.ico HTTP/1.1] org.apache.sling.engine.impl.SlingRequestProcessorImpl service: Resource /favicon.ico not found
==> request.log <==
17/Dec/2013:01:29:50 -0800 [3678] <- 404 text/html 6ms
==> access.log <==
<myip> admin 17/Dec/2013:01:29:50 -0800 "GET /favicon.ico HTTP/1.1" 404 393 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36"
What have broken ? Why is it happened?
In bundles I found just next differencies (compare broken instance and a same one unbroken):
Day CRX Sling - Token Authenticationcom.day.crx.sling.crx-auth-token 2.2.0.54 cq5 Active
Day CRX Sling - Token Authenticationcom.day.crx.sling.crx-auth-token 2.2.0.61 cq5 Active
Also I have on my broken instance one more active bundle:
Day Communique 5 WCM Geometrixx Gocom.day.cq.wcm.cq-wcm-geometrixx-go 5.4.0
Turn it off, but it didn't help.
After that I uploaded cq-content-5.4.jar in the package manager, installed it, restarted system.
But again I have the same error (Resource dumped by HtmlRendererServlet) for all pages. It did not help too.

It also can happen due to settings in Apache Sling Resource Resolver Factory settings. We faced same issue and found that the setting for Resource Search Path is missing all entry. Verify the default entry should have following:
/aps
/libs
/apps/foundation/components/primary
/libs/foundation/components/primary

I realise this is long after the fact, but perhaps it may be of use to future developers.
If you use the default GET servlet you need to configure a setting in the Apache Sling Get Servlet to render HTML. This can be found in the Apache Felix web console. You can access it here:
/system/console/configMgr
Then do a search for "Sling Get servlet". Inside your configuration you need to toggle the config setting for "Enable HTML" to select whether the HTML renderer for the default Get servlet is enabled or not.

Related

nginx errors with very large headers

When the user selects the ‘All’ filter on our dashboards, most queries fail and we get this error: 502 - Bad Gateway in Grafana. If it refreshes the page, the errors disappear and the dashboards work. We use an nginx as a reverse proxy and imagine that the problem is linked to URI size or headers. We made an attempt to increase the buffers: large_client_header_buffers 32 1024k. A second attempt was to change the InfluxDB method from GET to POST. Errors have diminished, but they still happen constantly. Our configuration uses nginx + Grafana + InfluxDB.
When using All nodes as filter on our dashboards ( the maximum of possible information), most of the queries return an failure (502 - Bad Gateway) on grafana. We have Keycloak for authetication and an nginx, working as an reverse proxy in front of our grafana server and somehow the problem is linked to it, when acessing the grafana server directly, trhough an ssh-tunnel for example, we do not experience the failure.
nginx log error example:
<my_ip> - - [22/Dec/2021:14:35:27 -0300] "POST /grafana/api/datasources/proxy/1/query?db=telegraf&epoch=ms HTTP/1.1" 502 3701 "https://<my_domain>/grafana/d/gQzec6oZk/compute-nodes-administrative-dashboard?orgId=1&refresh=1m" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" "-"
below prints of the error in grafana and the configuration variables
variables we use in them as a whole
error in grafana

Airflow 2.0 API response 403 Forbidden

I'm trying to trigger a new dag run via Airflow 2.0 REST API. If I am logged in to the Airflow webserver on the remote machine and I go to the swagger documentation page to test the API, the call is successful. If I log out or if the API call is sent through Postman or curl, then I get a 403 forbidden message. The same 403 error message is received in curl or postman whether I provide the web server username password or not.
curl -X POST --user "admin:blabla" "http://10.0.0.3:7863/api/v1/dags/tutorial_taskflow_api_etl/dagRuns" -H "accept: application/json" -H "Content-Type: application/json" -d "{\"conf\":{},\"dag_run_id\":\"string5\"}"
{
"detail": null,
"status": 403,
"title": "Forbidden",
"type": "https://airflow.apache.org/docs/2.0.0/stable-rest-api-ref.html#section/Errors/PermissionDenied"
}
The security for API has been changed to default, instead of deny_all (auth_backend = airflow.api.auth.backend.default). The installation of airflow has been done using pip using ubuntu 18 bionic. Dags are running fine if triggered manually or scheduled. The database backend is postgres.
Also tried copying the cookie details from Chrome into postman to get past this issue, but it did not work.
Here is the log on the web server for the two calls mentioned above.
airflowWebserver_container | 10.0.0.4 - - [05/Jan/2021:06:35:33 +0000] "POST /api/v1/dags/tutorial_taskflow_api_etl/dagRuns HTTP/1.1" 403 170 "http://10.0.0.3:7863/api/v1/ui/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
airflowWebserver_container | 10.0.0.4 - - [05/Jan/2021:06:35:07 +0000] "POST /api/v1/dags/tutorial_taskflow_api_etl/dagRuns HTTP/1.1" 409 251 "http://10.0.0.3:7863/api/v1/ui/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
I am using basic_auth for Airflow v2.0. The AIRFLOW__API__AUTH_BACKEND environment variable should be set to airflow.api.auth.backend.basic_auth. You will have to restart the webserver container. Then you should be able to access all stable APIs using the cURL commands with --user option.
In Airflow 2.0, There seems to be some bug.
If you set this auth configuration in airflow.cfg, it doesn't work.
auth_backend = airflow.api.auth.backend.basic_auth
But setting this as an environment variable works
AIRFLOW__API__AUTH_BACKEND: "airflow.api.auth.backend.basic_auth"
#AmitSingh was correct. Setting security to default only works with the experimental api. I changed the relevant configuration in airflow, restarted and added 'experimental' in the api path. Please see https://airflow.apache.org/docs/apache-airflow/stable/rest-api-ref.html
Maybe also good to know:
You can only disable authentication for experimental API, not the stable REST API.
See: https://airflow.apache.org/docs/apache-airflow/stable/security/api.html#disable-authentication

Wordpress site gets infected with malware, random POST requests from hackers return 200 results, trying to understand how this happens

A word press site i maintain, gets infected with .ico extension PHP scripts and their invocation links. I periodically remove them. Now i have written a cron job to find and remove them every minute. I am trying to find the source of this hack. I have closed all the back doors as far as i know ( FTP, DB users etc..).
After reading similar questions and looking at https://perishablepress.com/protect-post-requests/, now i think this could be because of malware POST requests. Monitoring the access log i see plenty of POST requests that fail with 40X response. But i also see requests that succeed which should not. Example one below, first request fails, similar POST Requests succeeds with 200 response few hours later.
I tried duplicating a similar request from https://www.askapache.com/online-tools/http-headers-tool/, but that fails with 40X response. Help me understand this behavior. Thanks.
POST Fails as expected
146.185.253.165 - - [08/Dec/2019:04:49:13 -0700] "POST / HTTP/1.1" 403 134 "http://website.com/" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko) RockMelt/0.9.58.494 Chrome/11.0.696.71 Safari/534.24" website.com
Few hours later same post succeeds
146.185.253.165 - - [08/Dec/2019:08:55:39 -0700] "POST / HTTP/1.1" 200 33827 "http://website.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.861.0 Safari/535.2" website.com
146.185.253.167 - - [08/Dec/2019:08:55:42 -0700] "POST / HTTP/1.1" 200 33827 "http://website.com/" "Mozilla/5.0 (Windows NT 5.1)

Apache logs out unknown IP address

I frequently (10 per sec) receive requests to my wordpress website.
See my apache access log:
www.mydomain.de:80 dedicated.server - - [16/Oct/2016:21:56:26 +0200] "POST /xmlrpc.php HTTP/1.0" 403 477 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
How do I figure out which ip is trying to access my apache webserver?
And how do I block it?
Normally I see an IP address but this log only shows "dedicated.server".
Based on the mod-log docs, for %h format string:
You might have the HostnameLookups directive set to On.
You might be defining them by name somewhere else.
I'd recommend using %a format string to log the client IP address.

Laravel Valet Share URL Leads to connection refused

Been trying to share the local site using a temporary url https://xxxxx.ngrok.io running with Laravel Valet. When I run Valet version 1.1.22:
valet --version
Laravel Valet version 1.1.22
securely the ngrok url leads to a connection refused. When it is unsecure it leads to connection refused as well (404 only with valet running on the secondary machine as it wouldn't be found there). Either that or a DNS resolving issue as I mention later on.
Locally on my wifi network and on the PC is works just fine. Access logs show me this:
127.0.0.1 - [03/Oct/2016:08:57:06 +0300] "POST /server.php?doing_wp_cron=1475474226.5450510978698730468750 HTTP/1.1" 200 0
127.0.0.1 - [03/Oct/2016:08:57:07 +0300] "POST /server.php HTTP/1.1" 200 47
127.0.0.1 - [03/Oct/2016:08:59:09 +0300] "POST /server.php?doing_wp_cron=1475474348.8563120365142822265625 HTTP/1.1" 200 0
127.0.0.1 - [03/Oct/2016:08:59:10 +0300] "POST /server.php HTTP/1.1" 200 47
Still do not see an error related to refused connection in this log at ~/.valet/Log/access.log . Error logs show old errors, not related to this issue. Ngrook window in terminal shows 301 Moved permanently on the two loads I just tried. Ngrok status site http://localhost:4040/status showed me:
GET / HTTP/1.1
Host: site.dev
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.8 (KHTML, like Gecko) Version/9.1.3 Safari/601.7.8
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us
X-Forwarded-For: xx.xx.xx.xxx
X-Forwarded-Proto: https
X-Original-Host: xxxxxx.ngrok.io
and then the redirect:
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: http://mysite.dev/
Server: Caddy
Status: 301 Moved Permanently
X-Powered-By: PHP/7.0.11
X-Ua-Compatible: IE=edge
Date: Mon, 03 Oct 2016 06:14:10 GMT
Content-Length: 0
Caddyfile here for completion (generated by Valet):
import /Users/jasper/.valet/Caddy/*
:80 {
fastcgi / 127.0.0.1:9000 php {
index server.php
}
rewrite {
to /server.php?{query}
}
log /Users/jasper/.valet/Log/access.log {
rotate {
size 10
age 3
keep 1
}
}
errors {
log /Users/jasper/.valet/Log/error.log {
size 10
age 3
keep 1
}
}
}
Ngrok is running too (added after tld domain was changed to .localhost):
ps aux | grep ngrok
jasper 1260 0.0 0.2 556735952 28692 s001 S+ 10:23AM 1:27.14 /Users/jasper/.composer/vendor/laravel/valet/bin/ngrok http -host-header=rewrite site.localhost:80
root 1254 0.0 0.1 2463108 8964 s001 S+ 10:23AM 0:00.01 sudo -u jasper /Users/jasper/.composer/vendor/laravel/valet/bin/ngrok http -host-header=rewrite site.localhost:80
jasper 3557 0.0 0.0 2432804 2096 s000 S+ 2:36PM 0:00.00 grep ngrok
So it does hit the Caddy Server and the ngrok status does show that. But it then does a redirect which translates into a connection refused or DNS resolution problemns for the browsers.. So what is the issue here?
In the end I realized WordPress was creating an extra redirect using its permalink structure. So when you turn off permalinks you can share your Laravel Valet WordPress site to the outside world using Ngrok. Not the perfect solution, but at least one that works and that allows you to show your work in progress to clients running it on your local machine.

Resources