Clients in singapore on Singtel cannot login and sometimes cannot access site

Question

This is my issue: http://ellislab.com/forums/viewthread/205006/P18

users in singapore are having an issue when posting content in various and random channels and other places in the control panel.

This goes for updating a post and publishing a new one. What happens is the user can navigate to the publish/edit screen fine, and change content, but when they click on submit, it boots them back to the CP home screen, and the form does not save the data to the channel.

No one else is having this problem around the world.

I suspect this is related to the IP address in the session so I did a code search for IP checking on form submits and couldnt find anything, but I may not have looked correctly.

This is my current security settings (not ideal but made some improvement to logins)

http://d.pr/i/b8Iz

Answer 1

This probably isn't the answer your looking for, but your mention of Singapore and then reading the conversation thread at Ellis Lab, my first thought was you're hitting some internet restriction, either by the ISP, but more likely by the country.

In Singapore the government via the Media Development Authority (MDA) bans, blocks, and otherwise monitors access to any website. It's possibly random, in that one ExpressionEngine site got banned for objectionable content— anything from humor to art to politics to religion or sexuality, and they created a profile ban that hits almost all ExpressionEngine sites.

It sounds like you guys have gone through a number of test with your clients, but I recommend one more: test with a VPN in place.

We deal with a client that travels back and forth to China and we've set them up with PandaPow. This has worked well, so far. Now, I can't say if PandaPow will work well for Singapore, but they do work hard to keep there servers off of various banned list, so they may.

You should also look at this article called: Best VPN for Singapore at Start VPN. We've never tried any of the VPNs listed in the article, but the focus is directly on avoiding Singapore restrictions (which can be hard, since they don't publish them and frequently deny that they are in place).

Start with a simple test. With PandaPow you can have one of your client's download the software, pay for a single month's membership, install the software, test to see if VPN is working, then test logging in to the Control Panel. They can try using a US or Europe based IP server.

If this works, then you know it's the ban that's effecting access and can decide to proceed from there.

You can also try other options as well, if you don't want to test the VPN immediately. I'd look at:

1. Change Control Panel Access from system folder to renamed admin.php file. The idea here is that if the MDA is blocking they maybe blocking one access protocol, but not another.

2. Check Blacklist make sure there aren't in bans on Singapore IP addresses or generic domains, like Singtel servers. Make sure you check .htaccess as well. It sounds crazy, but we once discovered a ban that blocked most of Russia (which we were fine with, except for 2 addresses, that we needed to have access).

3. Signup for a Content Delivery Network (CDN). This one is probably the least likely to work. Not because it couldn't work in theory, services like CloudFlare have CDN servers around the world, including Singapore. There DNS management may bypass Singapore government filters. But the reason why it's less likely to work, is ExpressionEngine's control panel javascripts don't work well under CloudFlare's speed enhancers (RocketScript), so generally a CloudFlare set-up excludes the Control Panel from CloudFlare protection and speed services. But just the overall DNS switch may work, so it can be tried.

I think the VPN is probably the top method, but I'd look at changing from system folder access to renamed admin.php access to the control panel as well, if you haven't yet.

Answer 2

I'm not sure whether it has been fixed or not, but there used to be a bug in EE where sessions were tied to a particular IP address (which I mentioned in that thread you linked to).

In many parts of Asia, the ISPs run a transparent proxy which can cause your http requests to appear to come from multiple IPs (the first page will come from one IP, the second from a totally different IP). You can verify if this is happening by opening up a few different "what is my IP address" type websites and compare the results (don't just refresh one, compare different sites). I've also run into this problem accessing EE over 3G mobile broadband connections in Australia, NZ, and Europe. I'm not sure how common this is in the rest of the world.

If you aren't running the latest version of EE, I'd recommend updating and see whether they've fixed it recently. Otherwise, I'd recommend either hacking the EE code to remove the totally pointless IP address check, or just bug EllisLab about it and try to get a fix (probably email the individual developers to get a response).

UPDATE: I just checked the source of the latest version of EE. Commenting out the following line 76 of system/expressionengine/core/EE_Security.php should fix your problem submitting forms at least:

$total = $EE->db->where('hash', $xid)
    // ->where('ip_address', $EE->input->ip_address())
    ->where('date > UNIX_TIMESTAMP()-7200')
    ->from('security_hashes')
    ->count_all_results();