Problem with changing the userprofile (website)

sander83 · Post by **sander83** » Sat Jan 19, 2019 2:34 pm

Support Request Template
What version of phpBB are you using? phpBB 3.2.5
What is your board's URL? http://n-spoorforum.nl
Who do you host your board with? tizm
How did you install your board? I used the download package from phpBB.com
What is the most recent action performed on your board? Update from a previous version of phpBB3
Is registration required to reproduce this issue? Yes
Do you have any MODs installed? No
Do you have any extensions installed? Yes
What version of phpBB3 did you update from? phpBB 3.0.13
What extensions do you have installed? Board Announcements 1.1.0
External Link In New Window 1.0.1
Image Upload 1.0.2
Share On 2.0.1
Who Visited This Topic 1.0.5
What styles do you currently have installed? prosilver
What language(s) is your board currently using? dutch
Which database type/version are you using? I Don't Know
What is your level of experience? New to PHP and phpBB
What username can be used to view this issue? any user
What password can be used to view this issue? No answer given
What actions did you take (updating your board; installing a MOD, style or extension; etc.) prior to this problem becoming noticeable? We have update the forum from 3.0.14 to 3.2.5
Please describe your problem. If we change the private website on the userprofile tab and we submit that change, it give a forbidden website page message.
Also if the user have allready a website filled in and change another field it give same error.
Generated by SRT Generator

Post by **stevemaury** » Sat Jan 19, 2019 3:18 pm

"forbidden website page message"

Which is . . .?

sander83 · Post by **sander83** » Sat Jan 19, 2019 4:54 pm

When we press on submit this screen comes:

janus_zonstraal · Post by **janus_zonstraal** » Sat Jan 19, 2019 9:05 pm

What permissions has the /upc.php?

david63 · Post by **david63** » Sat Jan 19, 2019 9:40 pm

sander83 wrote: ↑Sat Jan 19, 2019 2:34 pm Who do you host your board with? tizm

Are you sure about that? My information is that your board is hosted with Qweb Internet Services

This looks to me as if it could possibly be a server configuration problem.

sander83 · Post by **sander83** » Sun Jan 20, 2019 2:46 pm

janus_zonstraal wrote: ↑Sat Jan 19, 2019 9:05 pm What permissions has the /upc.php?

How can i view that? But if the permission was wrong shouldnt we not be able to even look at the profile? It just mess up when u submit it, so opening no problem.
The rights on the file system are on read for users so that should be fine, owner has change rights but i dont think that would be needed for users.

david63 wrote: ↑Sat Jan 19, 2019 9:40 pm
sander83 wrote: ↑Sat Jan 19, 2019 2:34 pm Who do you host your board with? tizm
Are you sure about that? My information is that your board is hosted with Qweb Internet Services

This looks to me as if it could possibly be a server configuration problem.

Sorry web development company is Tizm they host the server, but what would the server configuration be then?

david63 · Post by **david63** » Sun Jan 20, 2019 2:58 pm

sander83 wrote: ↑Sun Jan 20, 2019 2:46 pm but what would the server configuration be then?

No idea as I don't know what it is now and I am not a server administrator - I leave that to others.

Post by **stevemaury** » Sun Jan 20, 2019 3:17 pm

You can view the file permissions in your FTP client. That file should be 644. The error comes when you Submit because that is when a write is attempted.

sander83 · Post by **sander83** » Sun Jan 20, 2019 6:14 pm

File permission are 644 for all the files.

But i am wondering if it is really a file permission problem? It feels more like something goes wrong sending it to the database or something.

Cause only if u fill in the website line on the profile and submit it "crash" all the other fields u can change and submit without problems.

EA117 · Post by **EA117** » Sun Jan 20, 2019 6:41 pm

The error doesn't have to come from ucp_profile.php itself necessarily, since it could be coming from something else this module indirectly depends on. But I do see where ucp_profile.php will throw a 403 response because the user doesn't have permission to change the profile fields, which might fit with "the simplest explanation" theory.

This is the "Can change profile field information" permission that can be granted or revoked for a user or group. For example in the following ACP Permissions screen shot, where this permission is being granted through the Registered Users group:

I don't really know if you're supposed to get the "raw" 403 response in this situation like is being shown in your screen shot, or whether a more friendly error should have occurred. And I'm too lazy right now to test. But it's something you can check to see if this permission is available or not to the users experiencing the error, since there is a 403 involved in phpBB's reaction to absence of this permission.

3Di · Post by **3Di** » Sun Jan 20, 2019 10:33 pm

EA117 wrote: ↑Sun Jan 20, 2019 6:41 pm I don't really know if you're supposed to get the "raw" 403 response in this situation like is being shown in your screen shot, or whether a more friendly error should have occurred.

It's "ok" since uses trigger_error() here, old codeing. The *CPs sooner or later will be rewritten.

Code: Select all

			case 'profile_info':
				// Do not display profile information panel if not authed to do so
				if (!$auth->acl_get('u_chgprofileinfo'))
				{
					send_status_line(403, 'Forbidden');
					trigger_error('NO_AUTH_PROFILEINFO');
				}

sander83 · Post by **sander83** » Mon Jan 21, 2019 11:43 am

EA117 wrote: ↑Sun Jan 20, 2019 6:41 pm The error doesn't have to come from ucp_profile.php itself necessarily, since it could be coming from something else this module indirectly depends on. But I do see where ucp_profile.php will throw a 403 response because the user doesn't have permission to change the profile fields, which might fit with "the simplest explanation" theory.

This is the "Can change profile field information" permission that can be granted or revoked for a user or group. For example in the following ACP Permissions screen shot, where this permission is being granted through the Registered Users group:

fields.png

I don't really know if you're supposed to get the "raw" 403 response in this situation like is being shown in your screen shot, or whether a more friendly error should have occurred. And I'm too lazy right now to test. But it's something you can check to see if this permission is available or not to the users experiencing the error, since there is a 403 involved in phpBB's reaction to absence of this permission.

The users allready had this permission, olso me as admin have the same problem.

sander83 · Post by **sander83** » Mon Jan 21, 2019 1:49 pm

3Di wrote: ↑Sun Jan 20, 2019 10:33 pm
EA117 wrote: ↑Sun Jan 20, 2019 6:41 pm I don't really know if you're supposed to get the "raw" 403 response in this situation like is being shown in your screen shot, or whether a more friendly error should have occurred.
It's "ok" since uses trigger_error() here, old codeing. The *CPs sooner or later will be rewritten.
Code: Select all
			case 'profile_info':
				// Do not display profile information panel if not authed to do so
				if (!$auth->acl_get('u_chgprofileinfo'))
				{
					send_status_line(403, 'Forbidden');
					trigger_error('NO_AUTH_PROFILEINFO');
				}

if i slash out this piece of code i still get the same 403 page..
So it must be something else

EA117 · Post by **EA117** » Mon Jan 21, 2019 2:11 pm

3Di wrote: ↑Sun Jan 20, 2019 10:33 pm It's "ok" since uses trigger_error() here, old codeing. The *CPs sooner or later will be rewritten.

Thanks for the confirmation and clarification.

sander83 wrote: ↑Mon Jan 21, 2019 11:43 am The users allready had this permission, olso me as admin have the same problem.

Well I figured I at least owed actually testing it now.

Turns out that regardless of what might or might not have been enforced upon an attempt to submit changes to the profile fields when this permission has not been granted, before you ever reached that point, absence of this permission would have prevented the profile fields from even being shown in the UCP. i.e. Not even in "read-only mode, you can't change these" format; the profile fields "tab" is simply not there once you remove this permission. So its agreed, absence of phpBB permission doesn't fit with your symptom.

Looked for any kind of validation that was specific to phpbb_website profile field and/or type_url. But other than requiring an HTTP prefix on whatever string is entered, and a minimum length requirement, I couldn't find any "by design" reaction that was unique to this field content that could have clearly allowed a 403 status to be intentionally returned.

That's really hard to reconcile with your observation that "Cause only if u fill in the website line on the profile and submit it "crash" all the other fields u can change and submit without problems." File system permission issue is perhaps plausible there; e.g. a permission issue specifically attempting to use a file that is unique to this case. Such as /phpbb/profilesfields/type/type_url.php, which none of the other (default) profile fields would be attempting to use.

But when I test taking away read permission for that file, I get a PHP error even trying to display the the profile fields. (The ucp_profile.php page fails to display entirely, with status 500, citing "[phpBB Debug] PHP Warning: in file [ROOT]/phpbb/class_loader.php on line 160: require([ROOT]/phpbb/profilefields/type/type_url.php): failed to open stream: Permission denied") So although that would have been "specific to the URL field", it prevents display of the URL field too, and not just "on submit."

Making sure file system permissions are correct (recursively, particularly in the /phpbb/ and /vendor/ directories) can't be ruled out as related to the root cause. But the fact that "it only fails on changing the web site field" should be more of a clue here, and is hinting at something I'm not smart enough to appreciate yet.

3Di · Post by **3Di** » Mon Jan 21, 2019 2:43 pm

I would like to add that, as visible from the address in the image below, in the whole phpBB code there is only one chance that this error is called into question and no other occurrence. And that's exactly what I posted above.

Code: Select all

			case 'profile_info':