Problem with Apache and URLs containin .profile strings - php

I have come to this peculiar issue where Apache returns a 403 Forbidden message if anywhere in the url the string '.profile' apears.
Specifically I have stumbled upon this issue when trying to use Google's OAuth where after user provides authorization he is redirected back to the original website. In the return url variables are also provided like below
https://example.com/?state=M0L2Bse6HGHDDADgdsfsdfeefsfe3y0G&code=4%2F0AX4XfWiKNFYg4JtLESnSMmhr-HOHcM45mwn48yGSyi8FoTS3hZMZ4aTjjutw_ilUC9ZeNg&scope=email+profile+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&authuser=0&prompt=none#
which include the word '.profile' this will throw a 403 Error.
After a lot of experimenting I have found that removing or altering the '.profile' word in any way allows the request to go through.
I have edited .htacccess and removed all rules just to make sure but still the error persists.
I have also tried deploying the same project on nginx and it runs without any issues. Thus I believe this is Apache specific.
Anyone knows what could be off here?

Related

403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. PHP SOUND

I am using Xampp - vm for Mac osx.
I am having trouble with my phpsound installation. I keep receiving 403 error, which I have googled and read all the overflow comments.
I'm fairly new to this and have changed the permission of my folder for ex, file/get info/ change to read only. This did not work.
I also went into httpd-xampp.conf and edited to require all granted. Yet I am still getting the same error.
Is there anyway around this?
P.S - apology for the lack of info or coding language used
thanks

Unable to access the admin section of my Wordpress site

This is the URL of the site I am referring to: http://www.nagorik.org/
The site seems to be working fine.
However, when I am trying to access the admin site through http://www.nagorik.org/wp-login.php, I get the following message in Firefox:
Firefox has detected that the server is redirecting the request for this address in a way that will never complete.
This problem can sometimes be caused by disabling or refusing to accept cookies.
Any idea why this might be happening?
Some notes:
I checked the error log file; nothing new in it.
I have nagorik.org redirecting to www.nagorik.org
Firefox has detected that the server is redirecting the request for
this address in a way that will never complete. This problem can
sometimes be caused by disabling or refusing to accept cookies.
Let's try to check the cookie settings to see if it helps.
https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
One issue I see is you're missing a ton of Wordpress files in /wp-admin/. You might want to consider reinstalling wordpress or at least re-uploading the /wp-admin/ directory.

.Htaccess redirect giving 500 internal server error

Today I'm attempting to redirect
Http://www.motorcyclemonster.com/MyMRa/
to
Http://www.mymra.com/
The problem is I can't add anything without getting a 500 Internal Server Error. I can't even add a regular redirect without getting the dreadful 500 internal server error.
Supposedly there's a error file, however I can't find it.
Anyone have any idea why this problem might occur?
Htaccess file:
http://pastebin.com/7EQxZFCx
Sent to pastebin for simplicity reasons.
That file is too big for me to sift through. Perhaps you could do a binary search, deleting parts of the file until it works. Then, as soon as you've narrowed it down, paste that portion.

apache mod_security says - Access Denied error

Background -
I have my website code hosted on a linux server. My website allows new registrations for employers (http://www.gymandspajobs.com/Employer/Employer.php). The filled-up forms are verified by JavaScripts in the folder "/javascript" and if the information is found ok, the data is submitted via JavaScript HTTP request object and the PHP file "somefile.php" kept in the folder "/somefolder" under the root directory does the database inserts.
Problem -
When a new user tried to register using Firefox (I tested in WinXP SP2, Firefox - v3.5.2), the HTTP response I used to get (which I tapped in my JavaScript file) was
"You don't have permission to access /somefolder/somefile.php on this server." .
Surprisingly, the same functionality worked perfectly well in IE7 and Chrome.
Latest Update on the Problem -
I contacted my web hosting guys and my problem seems to have been solved after I received this reply from them.
We have disabled mod_security for your domain to fix it. We have entered the below lines to the .htaccess file under the httpdocs directory for your domain. We have also verified and successfully able to submit the Employer registration without any issues. ~~~~~ SecFilterEngine off ~~~~~
Though the problem has got solved, I think making "SecFilterEngine off" may not be the best solution to this problem as it compromises security. Hence I asked the hosting guys if there is a way to keep mod_security ON and yet get my functionality to work...... here is their reply.....
Q. is there any way my code can work yet keeping mod_security ON?
Ans. It is possible. But it is not easy. You have to modify the code in the file in such a way that the URI should not have the pattern "!(^application/x-www-form-urlencoded$|^multipart/form-data;)" because we found this entry in the apache error logs -
mod_security-action: 403
mod_security-message: Access denied with code 403. Pattern match "!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at HEADER("Content-Type")
I am using the HTTP object and POST method via JavaScript as -
http.setRequestHeader('Content-Type','application/x-www-form-urlencoded')
Please guide me as to what changes do I need to do in the above line of code so that mod_security can be kept ON and yet my registration form will work?
Thanks and Regards,
-Rupak Kharvandikar-
In this situation the best thing to do is to threat that specific warning as a false positive because it is. Remember that mod_security doesnt support content encoding and false positives is a very normal thing when you are dealing with WAF's.
Disabling all mod_security rules just for one false positive is dumb though. Look for the id of the rule that is getting triggered and disable it "SecRuleRemoveById". In my box I created an additional config to place all the rules i want to disable.
modsecurity_crs_60_myignores.conf
SecRuleRemoveById 960903
SecRuleRemoveById 970903
SecRuleRemoveById 970902
I managed to create an account in Firefox without any issues.

What causes an HTTP 405 "invalid method (HTTP verb)" error when POSTing a form to PHP on IIS?

I have one form in a PHP (5.2.9-1) application that causes IIS (Microsoft-IIS/6.0) to throw the following error when POSTed:
The page you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.
It's an HTTP 405 status code. All other forms in the application work, so I believe that the IIS 'verbs' setting for PHP pages is correct.
This is a customer's server, which I have no access to for verifying settings or testing code. All I can do is send the customer replacement files. Other customers on IIS servers have no such issue.
The form is perfectly straightforward:
<form method="post" action="index.php">
... fields ...
</form>
What can cause IIS to throw that error on one form only, but work fine on others?
I managed to get FTP access to the customer's server and so was able to track down the problem.
After the form is POSTed, I authenticate the user and then redirect to the main part of the app.
Util::redirect('/apps/content');
The error was occurring not on the posting of the form, but on the redirect immediately following it. For some reason, IIS was continuing to presume the POST method for the redirect, and then objecting to the POST to /apps/content as it's a directory.
The error message never indicated that it was the following page that was generating the error - thanks Microsoft!
The solution was to add a trailing slash:
Util::redirect('/apps/content/');
IIS could then resolve the redirect to a default document as is no longer attempting to POST to a directory.
I am deploying VB6 IIS Applications to my remote dedicated server with 75 folders. The reason I was getting this error is the Default Document was not set on one of the folders, an oversight, so the URL hitting that folder did not know which page to server up, and thus threw the error mentioned in this thread.
The acceptable verbs are controlled in web.config (found in the root of the website) in <system.web><httpHandlers> and possibly <webServices><protocols>. Web.config will be accessible to you if it exists. There is also a global server.config which probably won't. If you can get a look at either of these you may get a clue.
The acceptable verbs can differ with the content types - have you set Content-type headers in your page at all ? (i.e. if your Content-type was application/json then different verbs would be allowed)
By any chance have you tried POST vs post? This support article suggests it can cause problems with IIS: http://support.microsoft.com/?id=828726
I don't know why but its happened when you submit a form inside a page to itself by the POST method.
So change the method="post" to method="get" or remove action="anyThings.any" from your <form> tag.
It sounds like the server is having trouble handling POST requests (get and post are verbs). I don't know, how or why someone would configure a server to ignore post requests, but the only solution would be to fix the server, or change your app to use get requests.
We just ran into this same issue. Our Cpanel has expanded from PHP only to PHP and .NET and defaulted to .NET.
Log in to you Cpanel and make sure you don’t have the same issue.
I had this issue with a facebook application that I was developing for a fan page tab. If anyone faces this issue with a facebook application then
1-goto https://developers.facebook.com
2-select the application that you are developing
3-make sure that all the link to your application has tailing slash /
my issue was in the https://developers.facebook.com->Apps->MYAPPNAME->settings->Page Tab->Secure Page Tab URL, Page Tab Edit URL, Page Tab URL
hope this will help
As drewm himself said this is due to the subsequent redirect after the POST to the script has in fact succeeded. (I might have added this as a comment to his answer but you need 50 reputation to comment and I'm new round here - daft rule IMHO)
BUT it also applies if you're trying to redirect to a page, not just a directory - at least it did for me. I was trying to redirect to /thankyou.html. What fixes this is using an absolute URL, i.e. http://example.com/thankyou.html
i had to change my form's POST to a GET. i was just doing a demo post to an html page, on a test azure site. read this for info: http://support.microsoft.com/kb/942051
An additional possible cause.
My HTML page had these starting tags:
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
This was on a page that using the slick jquery slideshow.
I removed the tags and replaced with:
<html>
And everything is working again.

Categories