Fix User Token Issue in Opencart 3.2.0

USER Token ISSUE in Opencart 3.2.0 - for knowledgeable opencart coder it is quick and easy fix..... 1. When we try to SAVE the product in open cart - we cannot – screen goes to user token (see image 1 and 2). Error we get is this - every time we hit save - anything we save on the site....... Search - edit&user token=qAf3wwbX8H43qQEnkqnM0nNEvB9eLfn7&product id=6707 2. Site was working fine but yesterday we did upgrade for Immunify360 and server triggered that change. I contacted c-panel server help and they told me that MOD Security but either I am doing something wrong or not doing it correctly. Here is what they replied – but not sure if they are correct since they insist is Mod Security Issue. ---------------------------------------------------------------------------------------------------------------------------------------- Upon reviewing your issue, this appears to be caused by ModSecurity and can be observed within WHM » Security Center » ModSecurity™ Tools » Hits List: This is a false positive entry. This is most likely caused by the method Opencart uses to save any changes performed. You can either disable that specific rule by clicking on the rule itself and disabling it, or you can whitelist your IP address (recommended): How to whitelist an IP address in ModSecurity. After whitelisting myself, I could save the changes I had performed (all changes are reverted): ----------------------------------------------------------------------------------------------- Please note that ModSecurity and Imunify360 are different products and that they do not share a configuration file. /etc/apache2/conf.d/modsec/[login to view URL] is currently empty. Please follow the instructions in the following article to whitelist your IP addresses in ModSecurity. How to whitelist an IP address in ModSecurity [14:57:08 server2 root@94358613 ~]cPs# cat /etc/apache2/conf.d/modsec/[login to view URL] [14:57:32 server2 root@94358613 ~]cPs# ls -lah /etc/apache2/conf.d/modsec/[login to view URL] -rw------- 1 root root 0 Sep 1 04:58 /etc/apache2/conf.d/modsec/[login to view URL] [14:57:37 server2 root@94358613 ~]cPs# --------------------------------------------------------------------------------------------------------------------------------------------------- I asked them here if I can remove Imunity360 so maybe that will correct the problem. They replied. This issue is unrelated to Imunify360. The timing is coincidental. The issue was is caused by a ModSecurity rule from the default OWASP3 vendor. Disabling or uninstalling Imunify360 will not correct this issue. There are three ways to correct the behavior you are seeing. The first, and the most secure, way is to whitelist your IP addresses in ModSecurity. The next method is to disable the specific rule. The last, and the least secure, way is to disable the default vendor. If you need those links they sent me I have them..... How to whitelist an IP address in ModSecurity. How can I disable a ModSecurity rule? How to disable a ModSecurity vendor