Submitting form fails when the form data contains a <script> tag LAMP

Question

We have a hosted site that has a CMS we built running on a LAMP stack. We noticed that when you save HTML that has a tag embedded in the HTML the request immediately dies. This does not occur on the staging or local development instances of the CMS, so I'm assuming its a server configuration issue. Any ideas what might cause this behavior?

I've looked through the PHP.INI and apache confige files but nothing stood out as a possible culprit.

UPDATE I've filed a ticket with the host that runs our VPS, so far they haven't been helpful. As someone suggested I checked the apache logs to see if there were any problems. The only error I'm seeing is "Directory index forbidden by Options directive". That error seems to be happening independent of the form submit timing out.

We built the CMS using CakePHP and the CakePHP logs reveal no other useful information either. The request isn't making it to PHP at all as we put a die() call in the root index.php page and it still times out.

UPDATE2 Thanks for the suggestions. I'm confident that this will be resolved but figured it was worth taking it here first.

UPDATE3 MediaTemple was able to replicate the issue and said it was a Top Level Filtering Rule that was causing the issue, surely something out of my realm of control. All the same I appreciate the responses :)

Answer 1

Since you have system where this error does not appear it is a configuration error. Find the difference between the failing and the other systems.

If you have too many files to compare. Start reducing the complexity of the system as far as possible.

Answer 2

I've had similar problems caused by apaches mod_security. If you have mod_security enabled on the server, you can try something like this (in a .htaccess file):

<IfModule mod_security.c>
     SecFilterEngine Off
</IfModule>

Answer 3

Are you using an application-firewall? Sounds like some sort of security-programm just killing the request.

Answer 4

Does anything appear in your apache log files in relation to the request? If so, is there some sort of error message?