Support

Admin Tools

#14996 403 permission denied

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by vmurphy on Tuesday, 12 February 2013 06:29 CST

Monday, 11 February 2013 19:24 CST

vmurphy

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? yes
Have I searched the tickets before posting? yes
Have I read the documentation before posting (which pages?)? yes
Joomla! version: 2.5.9
PHP version: 5.3.20
MySQL version: 5.5.28
Host: rochen
Admin Tools version: 2.4.4

Description of my issue: Im getting a 403 error trying to use a download plugin (easy folder listing pro) with admintools. I've tried adding:

plugins/content/easyfolderlistingpro/eflp_files/download.php

to allow direct access to these files

but still getting the permission error. There must be another setting I need to tweak but I just can't seem to find it. Any pointers much appreciated.

Website is at: www.tdgraham.com

Error is visible at http://www.tdgraham.com/sp-neighbourhood

try to save any of the files on the page and gets an error like:

403 Permission Denied

You do not have permission for this request /plugins/content/easyfolderlistingpro/eflp_files/download.php?href=http://www.tdgraham.com/client_files/SP-Neighbourhood/SP-Sustainable%20Neighbourhood%20Brochr2013_ART.pdf&base=http://www.tdgraham.com/

Thanks.

Tuesday, 12 February 2013 02:02 CST

nicholas

Let's make sure that the problem is indeed caused by Admin Tools. In order to do so, try the following:

1. Try setting the Error Reporting level in your Global Configuration to "None". Many errors are caused by harmless PHP Notices and Warnings being output to the browser, breaking anything which requires HTTP header manipulation such as Joomla!'s session management, AJAX calls and download systems.

2. Try to replicate the issue after disabling the "System - Admin Tools" plugin. If you can still replicate the issue, it is not caused by Admin Tools. Disabling that plugin means that Admin Tools code (including the Web Application Firewall) is not running on your site.

3. If you suspect an issue with the .htaccess file, replace its contents with the contents of the stock htaccess.txt file shipped with every version of Joomla!. If you are on GoDaddy please wait for 1-30 minutes for the changes to be effective. Then, retry loading the problem page. If you can still reproduce the error, then it is not caused by .htaccess Maker.

If doing any of the above resulted in the issue still occurring, it's not related with Admin Tools and I can't help you. If doing any of the above did stop the issue from occurring, we'll have to do some troubleshooting.

First go to Admin Tools, Web Application Firewall, Configure WAF. Make sure "Log security exceptions" is set to Yes; if it's not, set it to Yes and click on Save. Now try reproducing your issue. Immediately after that, please go to Admin Tools, Web Application Firewall, Security Exceptions Log and go to the last page. The last log entry should have the date and time of when the issue occurred. Please copy the Reason and Target URL here so that I can help you.

If, however, you do not see a log entry, or the Date and/or IP address do not match your last access, this problem is not caused by Admin Tools' WAF. In this case, you will have to do some .htaccess troubleshooting. You may need to read the general .htaccess troubleshooting page, as well as the page on finding out necessary .htaccess exceptions.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 12 February 2013 05:58 CST

vmurphy

Hi Nicholas,

Thanks for your quick response. Here's my results so far:

1. Error reporting level was already set to none

2. Disabling the system admin tools plugin did not resolve the issues (however a complete uninstall of admin tools does resolve the problem)

3. Replacing .htaccess with stock version does solve the problem

Checked security exceptions log but its empty.

I'm guessing my problem is in .htaccess but I don't understand why uninstalling admintools fixes things. Maybe the uninstall puts stock .htaccess back in place?

Tuesday, 12 February 2013 06:10 CST

vmurphy

Hi,

I've managed to isolate the issue somewhat. In addition to the "allow direct access to these files" for 

plugins/content/easyfolderlistingpro/eflp_files/download.php

If I turn off "protect against file injection attacks", all works correctly.

Both items have to be in place to avoid the error.

There must be something in the problem url causing my problem. The url in question is:

/plugins/content/easyfolderlistingpro/eflp_files/download.php?href=http://www.tdgraham.com/client_files/SP-Neighbourhood/SP-Sustainable%20Neighbourhood%20Brochr2013_ART.pdf&base=http://www.tdgraham.com/

I asumming by turning off injection attack protection, I'm opening the site up somewhat but if there is no other solution, I guess I'll work with that.

Tuesday, 12 February 2013 06:18 CST

nicholas

#2 does not make any sense. When you disable the plugin or rename its files it doesn't run. I believe that you made a mistake and disabled the wrong plugin.

#3 also doesn't make sense with respect to #2. Uninstalling the component doesn't restore your .htaccess file.

I have an idea. Maybe that arbitrary PHP file (plugins/content/easyfolderlistingpro/eflp_files/download.php) somehow ends up loading all system plugins, no matter if they are disabled. I have seen something like that once and that would explain the crazy results in #2.

OK, here's what I would suggest you to do:

  • Only if you are using the .htaccess Maker, add plugins/content/easyfolderlistingpro/eflp_files/download.php to "Allow direct access to these files" in the .htaccess Maker and click on "Save and create .htaccess". You may also have to disable "Protect against common file injection attacks" on the same page.
  • If that didn't solve the problem, try renaming plugins/system/admintools/admintools.php to admintools.php-bak. If that works then the arbitrary PHP file is doing something wonky as I suspected and the only fix is to turn off the RFIShield (Remote File Injection protection) in Admin Tools' Configure WAF page.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 12 February 2013 06:24 CST

vmurphy

Hi Nicholas,

  I had already taken your first suggestion and that fixes the problem. The core issue seems to revolve around "protect against file injection attacks", once that's disabled all is ok. I found another posting on the net which sheds some light. Part of the query parameters includes a url:

/plugins/content/easyfolderlistingpro/eflp_files/download.php?href=http://www.tdgraham.com/client_files/SP-Neighbourhood/SP-Sustainable%20Neighbourhood%20Brochr2013_ART.pdf&base=http://www.tdgraham.com/

which I think is the issue triggering the problem. Guessing I need to find a different download component which does not operate in this fashion.

 

Tuesday, 12 February 2013 06:25 CST

nicholas

You definitely have to. Looking at the URL I have all this information about your folder layout that I shouldn't even be able to have access to.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 12 February 2013 06:29 CST

vmurphy

Understood. The only good issue is the links to these download pages are not available anywhere on the site and the client is not really concerned about protecting the files. Still I don't like the setup, too risky. Problem is the plugin involved does exactly what the client wants and its very simple. I guess I'm off searching. Thanks again for your help on this.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!