vb.org Archive - mod_security and No Permission Page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - mod_security and No Permission Page (https://vborg.vbsupport.ru/showthread.php?t=294358)

mod_security and No Permission Page

Quote:

Forbidden

You don't have permission to access /forums/admincp/automediaembed_admin.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

After working with them for a few days, I don't have any idea why this is happening, but it seems to be only happening with modifications, not vB core functions, but on every site I have vB installed (mine, my demo board and my client's website), and only when saving certain functions. They assure me that all my permissions are set, that mod_security has not logged any errors from any of my domains and that it's a vBulletin issue (3.8.5 or lower in all cases).

Specifically, what I've encountered is not being able to save settings where certain characters are being saved. For example, AME let's me save definitions that have RegEx patterns it uses to identify URL strings. I couldn't make any changes to those definitions until I either (grouped) or [bracketed] the http:// anywhere a RegEx would be saved. It still won't let me delete definitions, even if I blank all the fields. Another modification that lets me save human verification questions in a large form field, but I had to move the individual entries around before it wouldn't finally let me save it.

This doesn't seem to be a specific mod problem, but possibly a PHP problem. It's decidedly not a CHMOD issue. That the first thing I checked. I don't know what else to ask my host to look for to try and root out why I'm still having trouble. I do know that at least one setting let me get so far when trying to delete entries in a modification, but suddenly started denying me the first step. Is my forum just out of date? Are my mods just too old for PHP5? Or is it really mod_security that's the issues, and I have to figure out how to convince my host of that?

Quote:

Originally Posted by Digital Jedi (Post 2399316)

Earlier this week, I was making some changes to one my clients websites and, for no apparent reason, I was blocked by a firewall. Turns out I was blocked from all my websites on my host's servers. I got them to lift the firewall within a few minutes and went back to work, and the very first options I tried to save gave me the no permissions error, essentially like the one below.

After working with them for a few days, I don't have any idea why this is happening, but it seems to be only happening with modifications, not vB core functions, but on every site I have vB installed (mine, my demo board and my client's website), and only when saving certain functions. They assure me that all my permissions are set, that mod_security has not logged any errors from any of my domains and that it's a vBulletin issue (3.8.5 or lower in all cases).

Specifically, what I've encountered is not being able to save settings where certain characters are being saved. For example, AME let's me save definitions that have RegEx patterns it uses to identify URL strings. I couldn't make any changes to those definitions until I either (grouped) or [bracketed] the http:// anywhere a RegEx would be saved. It still won't let me delete definitions, even if I blank all the fields. Another modification that lets me save human verification questions in a large form field, but I had to move the individual entries around before it wouldn't finally let me save it.

This doesn't seem to be a specific mod problem, but possibly a PHP problem. It's decidedly not a CHMOD issue. That the first thing I checked. I don't know what else to ask my host to look for to try and root out why I'm still having trouble. I do know that at least one setting let me get so far when trying to delete entries in a modification, but suddenly started denying me the first step. Is my forum just out of date? Are my mods just too old for PHP5? Or is it really mod_security that's the issues, and I have to figure out how to convince my host of that?

What's the user/group associated with the file? If the group or user has been changed that may account for not being able to access the file.

It's possible Suhosin is doing this since it somehow found it's way into many popular package manager distributions of PHP5. I know this sounds too low-level for Suhosin, but you never know. -.-

After being the only member in a closed forum posting and editing posts all day, I got the No Permission Error on edit.php. Then...

Attachment 143448

You're a Jedi right? What happened to The Force? :D

It's really only good for heavy lifting.

--------------- Added [DATE]1359224956[/DATE] at [TIME]1359224956[/TIME] ---------------

Apparently, I triggered another mod_security filter, so an exception was added to my account. I hadn't been doing a lot of work on my site(s) in some years until recently. There's not much I find frustrating, since I know how random this stuff can be. But this level of security all seems a little unnecessary.

Turns out it was definitely related to mod_security. I had to have specific files set as exceptions from specific rules in order to correct the problem.

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (7)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.00993 seconds Memory Usage 1,732KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (7)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: