I am facing a problem when trying to post data to my PHP from html form.
The issue is as follows:
When I submit less data like a 1 paragraph of Lorem Ipsum it works fine.
Submitting more paragraphs it fails instantly with error 403 Forbidden.
Tried solving using SecFilterScanPOST Off on .htaccess but to no avail.
Error message image
To solve this error, #qtwrk's comment is correct that you must use the following code in your .htaccess.
<IfModule mod_security.c>
SecRuleEngine Off
SecRequestBodyAccess Off
</IfModule>
WordPress running on Litespeed Server will often fail with a 403 error when you try to post any content while creating new pages and posts in WP Admin. This code solves that issue.
A solution about disabling should help but it decreases security — stops doing that.
Better to spend more time understanding the main reason and for example configure mod_security for Wordpress:
Based on this article you can disable some rules directly for wp-admin directory:
<LocationMatch "/wp-admin/">
SecRuleRemoveById 300013
SecRuleRemoveById 300014
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
</LocationMatch>
Based on this article you can disable some rules directly for sub-directories:
<LocationMatch "/wp-admin/admin-ajax.php">
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
SecRuleRemoveById 949110
SecRuleRemoveById 980130
</LocationMatch>
<LocationMatch "/wp-admin/page.php">
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
SecRuleRemoveById 949110
SecRuleRemoveById 980130
</LocationMatch>
<LocationMatch "/wp-admin/post.php">
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
SecRuleRemoveById 949110
SecRuleRemoveById 980130
</LocationMatch>
If you want to be sure that mod_security is used you can wrap the settings above in this:
<IfModule mod_security.c>
# ...
# <LocationMatch ...>
# ...
</IfModule>
Related
there is a redirect chain issue on my website, regarding ahref testing tool: http://www.website.com/ ; http://website.com/ ; https://www.website.com/.
https://website.com/ - I use this link.
This code is written in the htaccess file, which probably cause the problem:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Header set Strict-Transport-Security: "max-age=31442830; includeSubDomains; preload"
The htaccess logic above should not cause a redirect unless you have a Cloudflare integration or Proxy that does not pass the secure protocol along to the apache server
if you have WordPress then a redirect can be made internally
I have some trouble to configure my apache 2.4 web server to host an asp .Net MVC project. The project is designed for the .Net framework 4.5. I have installed the mono framework (version 4.6.2), xsp and mod mono.
My problem is that the server displays me a list of files and directories of the project folder instead the Index.cshtml. It seems that the server don't redirect the URL to the mono server.
The mod_mono.conf in /etc/apache2/mods-enabled looks like:
AddType application/x-asp-net .aspx .ashx .asmx .ascx .asax .config .ascx
DirectoryIndex Global.asax
Include /etc/mono-server4/mono-server4-hosts.conf
The application specific configuration under /etc/apache2/sites-enabled contains:
<VirtualHost *:80>
ServerName SecurityWorkbench
ServerAdmin web-admin#SecurityWorkbench
DocumentRoot /var/www/html/SWB_WebApp
MonoAutoApplication disabled
AddHandler mono .aspx .ascx .asax .ashx .config .cs .asmx .axd
MonoServerPath SecurityWorkbench "/usr/bin/mod-mono-server4"
MonoSetEnv SecurityWorkbench MONO_IOMAP=all
MonoApplications SecurityWorkbench "/:/var/www/html/SWB_WebApp"
<Location "/">
Allow from all
Order allow,deny
MonoSetServerAlias SecurityWorkbench
SetHandler mono
SetOutputFilter DEFLATE
SetEnvIfNoCase Request_URI "\.(?:gif|jpe?g|png)$" no-gzip dont-vary
</Location>
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/javascript
</IfModule>
</VirtualHost>
Does anyone have an idea what's wrong with my configuration?
I installed Jenkins 2.32.2 on an Ubuntu 16.04 machine and configured Apache proxy as described on their wiki.
I changed these lines in /etc/default/jenkins:
HTTP_PORT=8380
JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT --prefix=/jenkins"
With these, I can access Jenkins at http://myhost:8380/jenkins/
For the proxy, I created the file /etc/apache2/conf-available/jenkins.conf with this content:
ProxyPass /jenkins http://myhost:8380/jenkins nocanon
ProxyPassReverse /jenkins http://myhost:8380/jenkins
ProxyRequests Off
ProxyPreserveHost On
AllowEncodedSlashes NoDecode
# Local reverse proxy authorization override
# Most unix distribution deny proxy by default (ie /etc/apache2/mods-enabled/proxy.conf in Ubuntu)
<Proxy http://myhost:8380/jenkins*>
Order deny,allow
Allow from all
</Proxy>
Then I enabled the configuration (with sudo a2enconf jenkins) and restarted Apache. Now I can access Jenkins at http://myhost/jenkins.
In principle it's OK, but in the "Manage Jenkins" page I get a message saying "It appears that your reverse proxy set up is broken." with a link to a wiki page with possible solutions.
One of the suggestions was to try this for diagnosis:
curl -iL -e http://myhost/jenkins/manage http://myhost/jenkins/administrativeMonitor/hudson.diagnosis.ReverseProxySetupMonitor/test
This is the output:
HTTP/1.1 403 Forbidden
Date: Thu, 16 Feb 2017 07:01:00 GMT
Server: Jetty(9.2.z-SNAPSHOT)
X-Content-Type-Options: nosniff
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
X-Hudson: 1.395
X-Jenkins: 2.32.2
X-Jenkins-Session: 7b3e99ac
X-You-Are-Authenticated-As: anonymous
X-You-Are-In-Group:
X-Required-Permission: hudson.model.Hudson.Read
X-Permission-Implied-By: hudson.security.Permission.GenericRead
X-Permission-Implied-By: hudson.model.Hudson.Administer
Content-Length: 973
Set-Cookie: JSESSIONID.34f83688=1rkbqf12ykw0w1clnm0l7cc9l6;Path=/jenkins;HttpOnly
<html><head><meta http-equiv='refresh' content='1;url=/jenkins/login?from=%2Fjenkins%2FadministrativeMonitor%2Fhudson.diagnosis.ReverseProxySetupMonitor%2Ftest'/><script>window.location.replace('/jenkins/login?from=%2Fjenkins%2FadministrativeMonitor%2Fhudson.diagnosis.ReverseProxySetupMonitor%2Ftest');</script></head><body style='background-color:white; color:white;'>
Authentication required
<!--
You are authenticated as: anonymous
Groups that you are in:
Permission you need to have (but didn't): hudson.model.Hudson.Read
... which is implied by: hudson.security.Permission.GenericRead
... which is implied by: hudson.model.Hudson.Administer
-->
</body></html>
Is that anonymous/403 a problem? In Jenkins, I get the error while being logged in.
I also checked "Jenkins Location / Jenkins URL" in settings, and it's OK: http://myhost/jenkins/
I had this problem.
You need to look at /var/log/jenkins/jenkins.log
In my case I had
WARNING h.d.ReverseProxySetupMonitor#getTestForReverseProxySetup: http://myhost/manage vs. https:%2F%2Fmyhost%2Fmanage
The trick is that both url should be the same. As can be seen, in my case, there was 2 problems:
the encoding of the slash, this has been sorted by adding nocanon at the end of ProxyPass.
ProxyPass / http://localhost:8083/ nocanon
the https became http, this has been sorted by adding the following line
RequestHeader set X-Forwarded-Proto https
I was trying to remove index.php from the URL of a Magento website:
_Turn on “use webserver rewrite”
_ Set permission 755 to necessary files and folders
_ make sure mode rewrite is on
_ configure htaccess file. comment, uncomment allow symlinks, change rewrite base from /magento/ to / or /var/www/hosts/www.domainname.com/ or /hosts/www.domainname.com/ or /www.domainname.com/
_reindex, flush cache
But all results in 500 server internal error.
In the log file I can see:
[Fri Apr 20 11:11:59 2012] [error] [client 88.87.40.140] client denied by server configuration: /var/www/hosts/www.nordocks.no/app/etc/local.xml
[Fri Apr 20 11:12:07 2012] [error] [client 117.5.178.168] Request exceeded the limit of 10 internal redirects due to probable configuration error.
And this is my .htaccess
############################################
## uncomment these lines for CGI mode
## make sure to specify the correct cgi php binary file name
## it might be /cgi-bin/php-cgi
# Action php5-cgi /cgi-bin/php5-cgi
# AddHandler php5-cgi .php
############################################
## GoDaddy specific options
# Options -MultiViews
## you might also need to add this line to php.ini
## cgi.fix_pathinfo = 1
## if it still doesn't work, rename php.ini to php5.ini
############################################
## this line is specific for 1and1 hosting
#AddType x-mapp-php5 .php
#AddHandler x-mapp-php5 .php
############################################
## default index file
DirectoryIndex index.php
<IfModule mod_php5.c>
############################################
## adjust memory limit
# php_value memory_limit 64M
php_value memory_limit 256M
php_value max_execution_time 18000
############################################
## disable magic quotes for php request vars
php_flag magic_quotes_gpc off
############################################
## disable automatic session start
## before autoload was initialized
php_flag session.auto_start off
############################################
## enable resulting html compression
#php_flag zlib.output_compression on
###########################################
# disable user agent verification to not break multiple image upload
php_flag suhosin.session.cryptua off
###########################################
# turn off compatibility with PHP4 when dealing with objects
php_flag zend.ze1_compatibility_mode Off
</IfModule>
<IfModule mod_security.c>
###########################################
# disable POST processing to not break multiple image upload
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
<IfModule mod_deflate.c>
############################################
## enable apache served files compression
## http://developer.yahoo.com/performance/rules.html#gzip
# Insert filter on all content
###SetOutputFilter DEFLATE
# Insert filter on selected content types only
#AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
# Netscape 4.x has some problems...
#BrowserMatch ^Mozilla/4 gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
#BrowserMatch ^Mozilla/4\.0[678] no-gzip
# MSIE masquerades as Netscape, but it is fine
#BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
# Don't compress images
#SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
# Make sure proxies don't deliver the wrong content
#Header append Vary User-Agent env=!dont-vary
</IfModule>
<IfModule mod_ssl.c>
############################################
## make HTTPS env vars available for CGI mode
SSLOptions StdEnvVars
</IfModule>
<IfModule mod_rewrite.c>
############################################
## enable rewrites
Options +FollowSymLinks
RewriteEngine on
############################################
## you can put here your magento root folder
## path relative to web root
#RewriteBase /
############################################
## workaround for HTTP authorization
## in CGI environment
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
############################################
## always send 404 on missing files in these folders
RewriteCond %{REQUEST_URI} !^/(media|skin|js)/
############################################
## never rewrite for existing files, directories and links
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
############################################
## rewrite everything else to index.php
RewriteRule .* index.php [L]
</IfModule>
############################################
## Prevent character encoding issues from server overrides
## If you still have problems, use the second line instead
AddDefaultCharset Off
#AddDefaultCharset UTF-8
<IfModule mod_expires.c>
############################################
## Add default Expires header
## http://developer.yahoo.com/performance/rules.html#expires
ExpiresDefault "access plus 1 year"
</IfModule>
############################################
## By default allow all access
Order allow,deny
Allow from all
###########################################
## Deny access to release notes to prevent disclosure of the installed Magento version
<Files RELEASE_NOTES.txt>
order allow,deny
deny from all
</Files>
############################################
## If running in cluster environment, uncomment this
## http://developer.yahoo.com/performance/rules.html#etags
#FileETag none
Please give me an instruction on how to deal with this error.
On my side it was not a permission problem but simply (and the same is in your .htaccess) the line with:
RewriteBase /
was commented.
Uncommenting it solved the problem.
Set permission 755 to necessary files and folders
You've hit a rock on this one. The permissions have been changed on items that need other permissions than 755 set.
Resetting File Permissions
The base things to watch out for are the files & directories that must be writeable:
- file: magento/var/.htaccess
- directory: magento/app/etc
- directory: magento/var
- all the directories under: magento/media
chmod o+w var var/.htaccess app/etc
chmod -R o+w media
I had this same problem.
The directory for my Magento website on my Ubuntu server is: /var/www/magento
When running Magento initial installation I selected "No" for Use Web Server Rewrites. This setting is under Admin Panel - System - General - Web.
In .htaccess of root magento folder after finishing the initial installation it had:
RewriteBase /magento/
As noted before my folder was /var/www/magento/
I changed Web Server Rewrites to Yes. In .htaccess I changed:
RewriteBase /
Works fine now.
I ran into this issue aswell
adding
RewriteBase /
to the .htaccess brought me a step further.
After this I ran into the next issue:
Could not determine temp directory, please specify a cache_dir manually";i:1;s:4307:"#0 /XXX/XXX/lib/Zend/Cache/Backend.php(217): Zend_Cache::throwException('Could not deter...')
Solution for this was to edit the
\lib\Zend\Cache\Backend\File.php
In the file.php search for
'cache_dir' => null,
and replace with
'cache_dir' => "var/tmp/",
I hope this saves somebody else some time.
I'm trying to get Ruby on Rails going on a Windows 2003 Server. I've installed the Mongrel service and Apache (and RoR, etc).
When I serve an app using just Mongrel, everything comes up perfectly.
So, now I am down to the Apache configuration... Apparently I can't seem to get that right. When I visit my pages, I am returned the correct HTML, but it's returned with the Content-Type set to text/plain instead of html or xhtml... In addition, If I try to get to one of the css pages, I get a 500 Internal Server error (served back as HTML, returned with the text/plain Content-Type).
Here is my Virtual Host file (Any help would be VERY VERY VERY appreciated!):
NameVirtualHost *:8080
#Proxy balancer section (create one for each ruby app cluster)
<Proxy balancer://myapp_cluster>
Order allow,deny
Allow from all
BalancerMember http://rails.localdomain.com:3010
#BalancerMember http://myapp:3011
</Proxy>
#Virtual host section (create one for each ruby app you need to publish)
<VirtualHost *:8080>
ServerName rails.localdomain.com
DocumentRoot c:/www/app/public/
<Directory c:/www/app/public/ >
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
ProxyRequests Off
ProxyPass / balancer://myapp_cluster
ProxyPassReverse / balancer://myapp_cluster
ProxyPreserveHost On
#SetOutputFilter INFLATE;DEFLATE
#SetOutputFilter proxy-html
#log files
ErrorLog c:/www/log/app_error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog c:/www/log/app_access.log combined
#Rewrite stuff
RewriteEngine On
# Check for maintenance file and redirect all requests
RewriteCond %{DOCUMENT_ROOT}/system/maintenance.html -f
RewriteCond %{SCRIPT_FILENAME} !maintenance.html
RewriteRule ^.*$ /system/maintenance.html [L]
# Rewrite index to check for static
RewriteRule ^/$ /index.html [QSA]
# Rewrite to check for Rails cached page
RewriteRule ^([^.]+)$ $1.html [QSA]
# Redirect all non-static requests to cluster
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule ^/(.*)$ balancer://myapp_cluster%{REQUEST_URI} [P,QSA,L]
# Deflate
#AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css
#BrowserMatch ^Mozilla/4 gzip-only-text/html
#BrowserMatch ^Mozilla/4\.0[678] no-gzip
#BrowserMatch \\bMSIE !no-gzip !gzip-only-text/html
</VirtualHost>
OK, here's part of the answer. This part deals with the .css and .js files. Apparently it relates to trailing slashes... I had to remove some slashes and add some others...
Removed:
DocumentRoot c:/www/app/public
<Directory c:/www/app/public >
Added:
ProxyPass / balancer://myapp_cluster/
ProxyPassReverse / balancer://myapp_cluster/
Now I can pull up the .css and .js files just fine...
HOWEVER: I am still having the issue of Apache NOT sending the right headers. Right inside the HTML that I'm returning I have this:
But it's STILL returning text/plain (the DefaultType as set in the httpd.conf).
PLEASE, if anyone has any ideas, let me know!!!!!
Thanks
I heavily recommend a linux host for RoR. Unicorn and Passenger are way better tools than mongrel clusters. See github blog post about it.