Suricata: PHP Fatal error: str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165

[4o4rh]

Getting the below the below when i switched from Suricata legacy mode to inline mode.

Crash report begins.  Anonymous machine information:

amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT amd64 1400094 #1 plus-RELENG_23_09_1-n256200-3de1e293f3a: Wed Dec  6 21:00:32 UTC 2023     root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_09_1-main/obj/amd64/Obhu6gXB/var/jenkins/workspace/pfSense-Plus-snapshots-23_09_1

Crash report details:

PHP Errors:
[07-Jan-2024 12:26:08 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:26:23 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:26:31 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:26:39 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:27:19 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:27:41 Europe/Berlin] PHP Fatal error:  str_ireplace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 165
[07-Jan-2024 12:28:11 Europe/Berlin] PHP Fatal error:  preg_replace(): Cannot use output buffering in output buffering display handlers in /usr/local/www/csrf/csrf-magic.php on line 163

No FreeBSD crash data found.

[4o4rh]

@gwaitsi it seems the trigger for this is;

• go into interface
• go into rules
• change available rule categories, to something else

[bmeeks]

Those error messages are not coming directly from Suricata package GUI code. They are coming from the Cross-Site Request Forgery logic in pfSense.

I have no clue what is causing that. The error is being generated in this file:

/usr/local/www/csrf/csrf-magic.php

which is not part of the Suricata package.

Perhaps it has something to do with language translation code ??? I see you are the Europe/Berlin time zone, so I assume maybe you have another language selected for the GUI besides English.

[jimp]

When you see an error like that in CSRF magic it usually means something else caused output on the page before it had a chance to load since it expects to be first in line.

So on that page if you view/inspect source and go to the very top of the file then you will probably see the actual underlying output/error that made CSRF fail.

[4o4rh]

@jimp thanks Jim, I'll try to reproduce and get the output.

[4o4rh]

@jimp still happening intermittently;

• only on the interface rules page
• only when changing rules to view from the dropdown
• gives a blank screen when it happens and the web developers screen returns nothing on the blank screen.
• has only started since I changed the interface from legacy to inline

not able to repeat consistently, so i have not been able to see the web developerer screen before/after it happens yet.