Please help with the membership form

[Rick]

I've been getting the odd reports of errors from the membership form, and I'd like to get some systematic data.

Please could folks go to the membership page on the website and submit a request using (say) "Browser Test" in the name field, and the name and version of the browser you're using in one of the other fields. If you get an error, please can you quote it and your browser version in this thread?

Thanks.

[Rick]

Windows XP Pro + Opera 7.11 worked fine. Thanks Ian

[Whitters]

W2K and ie6 OK

Form submitted
Your completed form has been mailed to webmaster@chocky.demon.co.uk.
Please be aware that your mail may take some time to be delivered.

Return to previous page, or Home Page. 2003-08-04 12:58:21 19jdyn-0007BH-00 <= nobody@http-2.homepages.demon.net U=nobody P=local S=960

[Delphine]

I have Windows XP and i.e. 6

It worked OK

[except I didn't follow your instructions about putting this info into one of the fields - sorry!]

[Rick]

Ok, so far they all seem to be working, which is good. I wonder why some folks have problems? Any ideas?

Tested Ok:
Netscape 4.7 Windows 2000
Netscape 7.0 Solaris
Opera 7.11 Windows XP Pro
IE 6 Windows 2000

[Mike]

Using old browsers maybe ?

[Rick]

No, I don't think it's that, 'cos one of the reports mentioned Opera. I think it's more likely something to do with the frame being http://www.orpington-astronomy.org.uk but the form page itself being http://www.chocky.demon.co.uk/oas/membership.html and some of the newer browsers having "security" settings which do dumb things under certain circumstances....

[Rick]

I wonder whether going straight to:

http://www.orpington-astronomy.org.uk/membership.html

and submitting the form will cause any other dificulties. I managed to get an error when submitting the form from my local master copy of the website:

X-Error: HTTP_REFERER doesn't match HTTP_HOST

which, I guess, when I'm using a local URL, probably makes sense....

[Rick]

I just tracked down another culprit. The intrusion detection system on the gallery webserver snarfed copies of some suspiscious-looking packets, and I was investigating....

It's Norton Internet Security Firewall.

For some reason it sometimes decides to mangle the "Referer" header and send instead a "Weferer" header containing garbage. Apparently it also turns Cookies into Wookies in similar manner. Why it bothers to send the garbage on at all is a complete mystery. Presumably it's something encrypted, but if nothing downstream can decrypt it then it's a complete waste of time.

Having spotted the weirdness, I've now disabled that particular (rather dumb) bad-traffic rule. Given it's a rule in the main Snort set, I expect it's resulted in a few false accusations....