XF 2.3 Cannot merge posts / move threads using inline moderation

[ckd]

Something strange is going on and I cannot figure it out. I have the following Super Moderator permissions (see below), however when I select two posts using Inline Moderation and trying to merge those two posts, the Inline Moderation bar below only offers me Deselect all. Same when I select multiple threads and try to move them to a different forum, the Inline Moderation bar below only offers me Deselect all.

What am I doing wrong? I am using XenForo for almost a decade now and I never felt so stupid. Moving an individual thread works fine, when I use the More Options menu instead of Inline Moderation.

 

[ckd]

Apparently the problem is related to private nodes, but I still cannot figure out, which permissions must be applied in order to get inline moderation working again.

 

[ckd]

After more than six hours of trial and error I have finally figured it out. It's apparently caused by Cloudflare...

I don't know why it happens or what is causing the behavior, but when enabling split-DNS the inline moderation suddenly displays all moderator features. When accessing the forum through Cloudflare again, just "Deselect All" is shown. I was able to reproduce this with all browsers... which leads back to the question, whether anyone else can confirm this?

I can reproduce this with all my forums... even on a newly installed XF, without any changes. Just create a new thread and trigger inline moderation. If Cloudflare is disabled, you got the moderator menu, if Cloudflare is enabled, you just get "Deselect All".

 

[ckd]

Yep! It's caused by the Web Application Firewall (WAF)!

 

[ckd]

In order to fix this, you must add the following path exception in your WAF:

/inline-mod/*

Skip these checks
Cookie signing ENABLED
Static URL hardening ENABLED
Form hardening ENABLED
Antivirus ENABLED
Block clients with bad reputation ENABLED
Skip these categories
Application attacks ENABLED
SQL injection attacks ENABLED
XSS attacks ENABLED
Protocol enforcement ENABLED
Scanner detection ENABLED
Data leakage ENABLED
Advanced
Never change HTML during static URL hardening or form hardening ENABLED
Accept unhardened form data ENABLED