No permission to access file
I have a very strange problem which I think may be a php or Apache problem or possibly how cPanel sets up the system. I run a website for an organization which has over 140 activity groups. The leaders of each group can publish details of their activities on the website for members to view. These details can be time independent or time dependent in terms of content and thus the details are editable. I have one group which has data on their activity which publishes without any issues and they can edit in the form, but fails to save with the message "You don't have permission to access /group_programme.php on this server. All the other groups are OK. The group that is failing has the longest piece of text and I have managed to track the error down to the string "and 1" and have determined that it can be "and n" where n is any digit.
I have a common function to cleanse data and have that set up with access from my system menu so that I can check data cleansing directly if I have any issues. So I entered "and 1" into this facility and came up with the same result. I moved it from my system menu to the public menu and it still produced the same result. I have one php file which is called twice, once with ?mode=form to display the input form and then with ?mode=result to display the result of the data cleansing. Because there were some calls to include libraries, I gradually commented out all external references and even exited the code in the result call before any data cleansing was done and still got the error.
I then split the routine into two files in case the reason for failure was calling the same file in the form action, but it still fails and then tried two files with no ?mode= parameters with no change.
I have now eliminated every variable I can think of, but I did change hosts in December. The text causing the failure has an entry for each month from January to December and the problem text occurred in July"s additions, meaning there were entries for months subsequent to July up to December, which must have worked. There have been no entries since December when the host was changed, but the group leader has only just started trying to edit the entry again. The new host is running with cPanel.
My conclusion is therefore that this is some bizarre interaction with PHP or Apache. It must occur after the submit button is pressed on the form, but before the page processing is started for the page specified in the HTML Form action parameter. Each time I get the error there is an entry in the cPanel error log of the form,
"File does not exist: /home/swindonu/public_html/member/403.shtml, referer: - Removed -"
I have tried this on Chrome, IE, Firefox and Edge all with the same results.
You can see the result at - Removed - ; goto the right-hand item on the menu bar Code Tests -> Input test and enter "and 1" into the first box. The entry in the drop down box doesn"t matter since the data cleansing is commented out. You can try any length of text with "and 1" embedded in it. There does need to be a break before the "and". It seems any non-alphanumeric character will do. So "sand 1" or "2and 1" will be OK, but "-and 1" will fail. In this test set up however it gets weirder as typing "and 1" into the large textarea box does not provoke a failure, whereas it does in the normal website.
Any ideas would be welcome.
-
OK been continuing to try and think of a search term that would lead to a useful result and just hit on "403 error text string" which led to "403 error due to specific text string" which mentioned "a similar problem with random 403, 500, and 503 errors. It turns out it was the Apache mod "mod_security"". And "after having the site white-listed from mod_security, it seems this issue is resolved". So I shall pursue that with my hosting provider first. 0 -
Hello :) Feel free to update this thread with the outcome after consulting with your hosting company about the Mod_Security rule set. Your hosting company should be able to review /usr/local/apache/logs/error_log and let you know which specific rule ID is leading to the behavior you have reported, assuming Mod_Security is the culprit. Thank you. 0 -
OK been continuing to try and think of a search term that would lead to a useful result and just hit on "403 error text string" which led to "403 error due to specific text string" which mentioned "a similar problem with random 403, 500, and 503 errors. It turns out it was the Apache mod "mod_security"". And "after having the site white-listed from mod_security, it seems this issue is resolved". So I shall pursue that with my hosting provider first.
The problem has now been fixed. Solution given was "The issue was some mis-configurations in PHP configuration file". Not very specific, but probably as good as I am going to get without a lot of digging.0 -
I'm happy to see the issue is now resolved. Thank you for updating us with the outcome. 0
Please sign in to leave a comment.
Comments
4 comments