Fix malformed application/x-www-form-urlencoded Content-Type headers

[webazex]

PR Title

Fix malformed application/x-www-form-urlencoded Content-Type headers

Commit message

fix(manager): correct malformed form-urlencoded Content-Type headers

PR Description

Summary

Fix malformed Content-Type headers used by several XMLHttpRequest calls in the Manager.

Some requests currently send:

Content-Type: application/x-www-form-urlencoded;

The trailing semicolon has no parameter after it, which makes the media type malformed.

Strict HTTP request validation may reject these requests before they reach Evolution CMS.

Reproduction

On a fresh Evolution CMS installation running behind nginx with ModSecurity and OWASP Core Rule Set 4.29.0 enabled, the Manager login request was rejected with:

OWASP CRS rule 920470
Illegal Content-Type header
HTTP 406 Not Acceptable

The rejected request contained:

Content-Type: application/x-www-form-urlencoded;

After removing the trailing semicolon, the Manager login works normally without disabling ModSecurity or adding any WAF exclusions.

Changes

Removed the invalid trailing semicolon from affected Manager XMLHttpRequest headers.

Affected files:

• manager/actions/category_mgr/skin/js/categories.js
• manager/media/style/common/login.tpl
• manager/media/style/default/chunks/welcome/StartUpScript.tpl
• manager/media/style/default/js/evo.js
• manager/media/style/default/login.tpl

Existing valid headers such as:

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

are left unchanged.

Expected behavior

Manager requests should send a valid media type:

Content-Type: application/x-www-form-urlencoded

and should not require a ModSecurity exclusion to function.

Tested

Tested on a fresh Evolution CMS installation with:

• nginx
• ModSecurity
• OWASP CRS 4.29.0

Before the change, Manager login was blocked by CRS rule 920470 with HTTP 406.

After the change, login succeeds with ModSecurity still enabled.