403 Forbidden on posting.php

Get help with installation and running phpBB 3.0.x here. Please do not post bug reports, feature requests, or MOD-related questions here.
Scam Warning
Forum rules
END OF SUPPORT: 1 January 2017 (announcement)
User avatar
Phil
Former Team Member
Posts: 10403
Joined: Sat Nov 25, 2006 4:11 am
Name: Phil Crumm
Contact:

Re: 403 Forbidden on posting.php

Post by Phil »

mod_security is an Apache module that's supposed to improve security by preventing certain keywords from being submitted via POST and GET.
Moving on, with the wind. | My Corner of the Web
quoth
Registered User
Posts: 13
Joined: Sat May 21, 2005 10:24 am
Location: Tasmania, Australia
Contact:

Re: 403 Forbidden on posting.php

Post by quoth »

thanks for your quick and concise answer. :D

Does the workaround leave holes in the security? I know nothing of .htaccess files, and don't have time to research untill tomorrow afternoon.

Cheers,
EightOhProlene
Registered User
Posts: 155
Joined: Sun Jan 18, 2004 4:44 pm

Re: 403 Forbidden on posting.php

Post by EightOhProlene »

Just had this problem myself, from out the blue. Would like to hear more about it.
User avatar
Phil
Former Team Member
Posts: 10403
Joined: Sat Nov 25, 2006 4:11 am
Name: Phil Crumm
Contact:

Re: 403 Forbidden on posting.php

Post by Phil »

quoth wrote:thanks for your quick and concise answer. :D

Does the workaround leave holes in the security? I know nothing of .htaccess files, and don't have time to research untill tomorrow afternoon.

Cheers,
I've never actually heard of anything being prevent by mod_security, actually, so disabling it should be fine.
EightOhProlene wrote:Just had this problem myself, from out the blue. Would like to hear more about it.
As per this thread, it's usually caused by mod_security. You can do as suggested to figure out what is triggering it (keep trying to post small chunks until it errors out, then reduce the size of that chunk to see what's tripping it), but I'd just have it disabled (mod_security that is).
Moving on, with the wind. | My Corner of the Web
tonygil
Registered User
Posts: 4
Joined: Wed Apr 23, 2008 2:04 pm

Re: 403 Forbidden on posting.php

Post by tonygil »

SOLUTION:

the problem is being caused by your host's apache security settings: modsecurity. it is blocking certain keywords. in my case the problem was with the word GET or any variation: target, forget, getty, etc etc.

talk to support and they can fix it in no time.

other references:

http://www.integramod.com/forum/solved- ... t2466.html
Ford Warrior
Registered User
Posts: 4
Joined: Sun Jan 30, 2011 4:27 pm

Re: 403 Forbidden on posting.php

Post by Ford Warrior »

where is this mod_security file located? .... specifically would it be on the control board or perhaps in the filing system?
User avatar
KevC
Support Team Member
Support Team Member
Posts: 70280
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: 403 Forbidden on posting.php

Post by KevC »

Neither. It's a function on the hosting side.
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"
User avatar
M.O.B.
Registered User
Posts: 942
Joined: Tue Jan 04, 2005 1:07 am
Location: San Diego CA USA
Contact:

Re: 403 Forbidden on posting.php

Post by M.O.B. »

My site is also having this same issue: http://www.mixingonbeat.com/phpbb/viewt ... f=3&t=8796

I will report this to my host. In my case it seems to trigger the error when we type the following sequence of text with numbers:

or 19"

but seems to be fine if we write it like this:

or (19")

I tried entering the code (mentioned in the first page of this thread) in the .htaccess file in the root of the forum, but triggered a new error blocking the entire site.
Image
User avatar
murdock
Registered User
Posts: 20
Joined: Wed Nov 19, 2003 1:47 am
Location: New Jersey
Contact:

Re: 403 Forbidden on posting.php

Post by murdock »

Thanks for this. I just had the same problem. Everything was fine on my site until my host moved me to Apache 2. Lots of stuff broke, and I am going through the pages fixing things one by one. While I am doing this, I am archiving my old code in a "admin only" forum in case I ever need it again later. I made one post with no problem. Then went to make another post a few minutes later and hit the 403 error. And my search brought me here. So I decided to look in the error logs, and found this:

Displaying: error_log
[Fri Dec 02 01:03:09 2016] [error] [client xx.xx.xx.xx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[[:space:]]*script" at ARGS:message. [file "......./apache2/conf/httpd.sec.conf"] [line "134"] [hostname "www.zzzdomainzz.com"] [uri "/forum/posting.php"] [unique_id "ERTSFDHS456ERFDGSDF"]

Adding the SecFilters didn't work for me. My host has compiled the module to forbid this. I had to contact them to fix it.
User avatar
Lumpy Burgertushie
Registered User
Posts: 68304
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: 403 Forbidden on posting.php

Post by Lumpy Burgertushie »

looks like they did not setup the server correctly and/or their "mod_security" program is not set correctly.

if your board was working before the server move then it should still work just fine after the move if the host did it right.

robert
I'm baaaaaccckkkk. still doing work on donation basis. PM your needs.

Premium phpBB 3.3 Styles by PlanetStyles.net

If nobody is in the forest, does a tree really fall?
Locked

Return to “[3.0.x] Support Forum”