Disallowed Key Characters in CP - only one user

Question

I've got an EE 2.8.1 site where one user cannot access a specific channel. He gets the message "Disallowed Key Characters". It only happens for this single user. Highlights:

• Only happens for the one user
• User is part of a member group and no one else in the member group has the issue
• I've walked him through clearing all of his cache, cookies, history, everything. switched from his ISPs DNS to Google helped flused his local DNS hoping to clear everything out, all with no success.
• Tried multiple browsers and two machines.
• We are using Zoo Flexible Admin, and it happens when he clicks a link we setup to directly create an entry for a specified channel (again though, others use that same menu with no issues)
• I administer about 50 EE installs and I've always been able to fix this by clearing cache, cookines, or permission issue. None of those seem to work this time.

any ideas? thanks

UPDATES based on comments below: - while navigating the control panel, I only get this while on his machines. I can log in as the user just fine

- offending url is : http://www.domainname.com/system/admin.php?/cp/content_publish/entry_form?channel_id=1

- htaccess:

#secure .htaccess file
<Files .htaccess>
  order allow,deny
  deny from all
</Files>

# EE 404 page for missing pages
ErrorDocument 404 /index.php/site/404

#Block Access to directories with no index file
Options -Indexes

# Simple 404 for missing files
<FilesMatch "(\.jpe?g|gif|png|bmp|css|js|flv)$">
  ErrorDocument 404 "File Not Found"
</FilesMatch>

# Although highly unlikely, your host may have +FollowSymLinks enabled at the root level, yet disallow its addition in .htaccess; in which case, adding +FollowSymLinks will break your setup (probably a 500 error), so just remove it, and your rules should work fine.
#Options +FollowSymlinks
RewriteEngine On
RewriteBase /

RewriteCond %{THE_REQUEST} ^GET
RewriteCond %{THE_REQUEST} ^[^/]*/index\.php [NC]
RewriteRule ^index\.php(.+) $1 [R=301,L]

# Add the www
RewriteCond %{HTTP_HOST} ^domainname\.com
RewriteRule ^(.*)$ http://www.domainname.com/$1 [R=permanent,L]

#Removes index.php from ExpressionEngine URLs
RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

#RewriteCond %{HTTP_HOST} ^(blog|news).domain.com$ [NC]
#RewriteRule ^$ %1/ [L]

Answer 1

Found some suggestions in the EllisLab Forums that might help.

In the system/codeigniter/system/core/input.php file:

Find the function _clean_input_keys($str)

Change:

exit(‘Disallowed Key Characters.’);

to:

exit(‘Disallowed Key Characters.’. $str);

This will tell you what characters are causing you problems. Then you can follow the suggestions above to add them to the regex string. In my case, I just changed the input’s name.

Once you know what the offending character is you may choose to allow it.

In the system/codeigniter/system/core/input.php file see the the _clean_input_keys function to add the offending character. This may have security implications.

Other suggestion from the same source is to add a cookie prefix.

$config['cookie_prefix'] = 'im_';

Answer 2

From this post over on EllisLabs : https://ellislab.com/forums/viewthread/81867/

What is happening when that message displays (as you will probably know) is that there is something that is setting cookie/post/session variable with a key that contains a character in the dis-allowed list.

Are you sure there's no dodgy characters in the users username or something like that?

What you could do is apply the patch in the post above, copied below, this might tell you the string (or key) that is causing the offence at least, and help you narrow it down.

/system/codeignitor/system/core/input.php, around line 728 (on EE2.10.1) look for the below if statement and replace with the below :

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
{
    set_status_header(503);
    exit('Disallowed Key Characters. The offending key is : '.$str);
}  

DO NOT leave this code in, it doesn't clean the offending string just echoes it so it's potentually dangerous, only use for debugging

The process of ellimination tells us it is something specific to the user, ie the user data or something in the users cookies, you tried different browsers so it's not likely to be that, perhaps you've managed to get a disallowed character into the session ID? Have you cleared the exp_sessions table and checkthe the user in quesiton (in exp_members) for anything that looks 'funky'?? I seem to recall triggering this erro when I tried to overwrite a users hashed password once...

Also see this post : https://ellislab.com/forums/viewthread/84889/ seems there can be some come-uppance with 3rd party cookies, especially if they have the dollar symbol in their key...

Edit : Update following feedback below

Ok, the string reported points to a GET parameter, from what you've posted it looks like he's calling a URL with an EE path (/cp/content_publish/entry_form) and get parameters ?channel_id).

If we put it all together with a fake domain seems he's calling your.comain.com/cp/content_publish/entry_form?channel_id. Now, if we assume your using friendly URL's (please share your .htaccess) the .htaccess will add /index.php/ to your url making your.domain.com/index.php/cp/content_publish/entry_form?channel_id, doesn't strike me as too strange however we know that what he reported is JUST the key, so we know that the parameter boundry (?) is getting applied before the path, after the domain, something like this : your.domain.com/index.php?/cp/content_publish/entry_form?channel_id=Summin

The above string makes sense in that the URL is your.domain.com/index.php then the parameter boundry, then the next part is the first 'key' (i.e. /cp/content_publish/entry_form?channel_id) and the value following the = is the value, the next parameter being split by an ampersand &. I suspect that the link being created is malformed for some reason.

What we need to see is 1. The URL being produced and 2. The URL actaully being processed. For one you'll have to ask your user to copy the link location on the link or log in as him and get it yourself (check his browser too). 2 can be taken care of with this modification in the same place as above :

if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
{
    $port = $s['SERVER_PORT'];
    $host = empty($_SERVER['HTTP_X_FORWARDED_HOST']) : $_SERVER['http_host'] ? $_SERVER['HTTP_X_FORWARDED_HOST'] ;
    $reqUrl = "http";
    if ( !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on' ){
        //ssl
        $reqUrl .= 's://' . $host . ($port=='443' ? '' : ':' . $port);
    } else {
        $reqUrl .= '://' . $host . ($port=='80' ? '' : ':' . $port);
    }
    $reqUrl .= $_SERVER['REQUEST_URI'];

    set_status_header(503);
    exit('Disallowed Key Characters. The offending key is : '.$str
    . "<br />The URL requested was : <pre>" . $reqUrl . "</pre>" );
} 

Again, don't leave this in place, pop it in, get a test result and take it out.

Edit 2 : Following reveal of Generated URL and .htaccess

Looks like the link you're creating in the CP is not valid. Modern browsers may interfere/correct this, some browsers may not. Notice the 2 question marks in your URL??

Good news is (thanks for the extra info btw :) ) I can test this URL in my sandbox! Looks like we're missing a number of things from the URL...

Firstly is the CP Session ID, I realise you could be using the 'non' Session ID type of session type (Admin > Security & Privacy > Security and Sessions > Control Panel Session Type) however if you're default you'll need the S parameter...

Also related to this is if your user is deliberately blocking cookies, if you have Cookies Only as your CP session type and the user's blocking cookies then we've an issue.

Next, thanks again for sharing the .htaccess, but is this the .htaccess from inside the system directory?? if you look at your URL you'll see the path is /system/admin.php, ergo we're browsing a sub directory. you should have admin.php in the site root?May not be relivent against the EE version, please ignore

Finally, can you share the code that creates your link please???

Finally, regardless of all the above questions, here's my stab at creating your link, this should deal with the session variables and your 'double parameter marker' issue...

//Create link to content_publish controller, entry_form method, channel_id of 1
$urlToEntry = BASE . AMP . 
              'C=content_publish' . AMP . 
              'M=entry_form' . AMP
              'channel_id=1';

Try this as a 'drop in' replacement and see if you get further with it? Let us know if this changes the generated link and if it works as the other link does (it should!)

Here the BASE definition in the EE CP is the whole base URL for the CP, including the session id if applicable and the cp indicator, the rest is the MVC style of call in the CP. Tested on EE 2.7.1 & 2.10.1.