Support

Admin Tools

#14808 htaccess

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Monday, 28 January 2013 11:04 CST

user56511

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.8
PHP version: 5.3.14
MySQL version: 5.1.36
Host: www.temporal-lobe.com
Admin Tools version: 2.5.8

Description of my issue:

The rules in .htaccess, which I generated with admin tools, break the functionality of a plugin called ajaz-zoom. I have now temporarily removed the .htaccess files, but this may be unsafe.

When the .htaccess file is in place, I get a 403 error for a php file. When this file is added to exceptions, I get a 500 error. Is there a way to add entire directories with a wildcard to the exceptions list? If so, how is it done?

What part of the .htaccess could be causing this error?

thanks for any help you can provide.


Niels

nicholas
Akeeba Staff
Manager

Hello Niels,

You can always follow the step by step troubleshooting instructions found at: https://www.akeebabackup.com/documentation/troubleshooter/athtaccessexceptions.html Most likely you'll see that there is a specific .php file which needs to be accessed directly, therefore you have to add an exception for it in .htaccess Maker.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user56511

Thanks Nicholas

This is the Chrome output I got with .htaccess enabled. I added zoomload.php to the files list that can be accessed directly. I even added the entire axZM folder to the list of files that can be added directly. I attached my htaccess file (now zipped).

Any suggestions to change the settings and get this working are much appreciated.

Thanks,

Niels

  1. Request URL: http://www.temporal-lobe.com/ajaxZoom3_3/axZm/zoomLoad.php?zoomLoadAjax=1&example=17&3dDir=../pic/zoom3d/Uvex_Occhiali&_=1359390824223
  2. Request Method: GET
  3. Status Code: 403 Forbidden
  4. Request Headersview source
    1. Accept: text/html, */*; q=0.01
    2. Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
    3. Accept-Encoding: gzip,deflate,sdch
    4. Accept-Language: en-US,en;q=0.8
    5. Cache-Control: no-cache
    6. Connection: keep-alive
    7. Cookie: PHPSESSID=d663445e0bc70763112cdd82eb1b8422
    8. DNT: 1
    9. Host: www.temporal-lobe.com
    10. Pragma: no-cache
    11. Referer: http://www.temporal-lobe.com/ajaxZoom3_3/examples/example15_clean.php
    12. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.56 Safari/537.17
    13. X-Requested-With: XMLHttpRequest
  5. Query String Parametersview sourceview URL encoded
    1. zoomLoadAjax: 1
    2. example: 17
    3. 3dDir: ../pic/zoom3d/Uvex_Occhiali
    4. _: 1359390824223
  6. Response Headersview source
    1. Connection: Keep-Alive
    2. Content-Length: 302
    3. Content-Type: text/html; charset=iso-8859-1
    4. Date: Mon, 28 Jan 2013 16:33:44 GMT
    5. Keep-Alive: timeout=15, max=98
    6. Server: Apache

nicholas
Akeeba Staff
Manager

You also have to disable the "Protect against common file injection attacks" option. But this is dangerous. My advice? Find a replacement for the extension you're using.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user56511

Thanks! That enabled a view.

Is there perhaps a way to create an exception in the WAF for this? There is no similar component - have a look - I really like it.

http://www.temporal-lobe.com/ajaxZoom3_3/examples/example15_clean.php

If no exception for this can be made in the WAF or .htaccess file, what should I ask the developer of this component to change? Thanks, Niels

 

 

 

 

 

 

nicholas
Akeeba Staff
Manager

Hm, yes, I have not seen any alternatives to that. The only problem I see is that they accept a relative path in the 3dDir parameter. This is bad practice. Actually, it's recommended that servers don't allow this behaviour because vulnerable scripts may end up leaking information about the server or the application. They could probably define the paths as relative to the site's root, avoiding the double dot in the query parameters, making the extension compatible with my (and other developers' and system administrators') file injection protection.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!