Page 1 of 2

Can't update my profile

Posted: Tue May 28, 2019 6:11 am
by lavalamp213
Hello,
Just tried to update some info in my profile and got this error messgae:

Forbidden
You don't have permission to access /ucp.php on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at www.cultoftarotforum.com Port 443


Any idea what this could be? I just discovered this. Don't know if the forum members are having this issue.

Thanks for any help.

Re: Can't update my profile

Posted: Tue May 28, 2019 6:39 am
by david63
I am assuming that you are referring to your own site and not here.

It sounds as if there is something wrong with your server file/folder permissions and/or owner

Re: Can't update my profile

Posted: Tue May 28, 2019 6:42 am
by .m.
ucp.php file is not accessible. check its ownership permissions.
in general, file should have chmod 644 or chmod 664

more details : chmod permissions

Re: Can't update my profile

Posted: Tue May 28, 2019 6:46 am
by lavalamp213
Thank you.

I will have a look at this.

Re: Can't update my profile

Posted: Tue May 28, 2019 7:52 am
by KevC
That sort of issue also happens if the server's mod_security is tripped.

What exactly were you changing and to what?

Re: Can't update my profile

Posted: Tue May 28, 2019 9:02 am
by lavalamp213
I was changing a website address in my user profile.

I then tried changing other things in my user profile, same problem.

However, though I haven't checked every function, other functions in my UCP seem okay. Just the User Profile seems to be giving me the problem.

I recently did make a change to my mods, de-authorising two of them.

Re: Can't update my profile

Posted: Tue May 28, 2019 9:23 am
by .m.
as KevC said, the problem appears to be due to mod_security

your webhost control panel might be having a link to disable it.
if you cannot find mod_security then contact your web host.

Re: Can't update my profile

Posted: Tue May 28, 2019 9:42 am
by lavalamp213
Where would I look for mod_security ?

Would that be at my webhost or in my ACP, and where?

Thanks

Re: Can't update my profile

Posted: Tue May 28, 2019 10:00 am
by david63
lavalamp213 wrote:
Tue May 28, 2019 9:42 am
Where would I look for mod_security ?
Normally you do not have any control over those settings - you will need to get your host to change them. But first you will need to know what it tripping it. Start by entering the data that causes the problem and then remove it bit by bit until it clears. Armed with that you can then report it to your host.

Re: Can't update my profile

Posted: Tue May 28, 2019 10:15 am
by lavalamp213
I'm sorry, I don't understand these instructions.

The problem happens when I try to change or add anything in my user profile.

For example, what brought me there in the first place was I was trying to change a web address I give in my profile.

I then realised I am unable to make any change in the profile at all.

---
I just tried something.

I tried to make this profile change using the "User Adminstration" tool in the ACP and I got this message:
Not Acceptable!
An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.
So, looks like you guys nailed it.

But here's the weird thing, I just tried the same thing, but making a change to a member's profile and it worked.

It seems to be that I can't change my own is all.

Re: Can't update my profile

Posted: Tue May 28, 2019 10:39 am
by KevC
mod_security can be very fickle.
You need to tell your hosts what you're changing and the page address and they will white list it for you.

Re: Can't update my profile

Posted: Tue May 28, 2019 12:02 pm
by lavalamp213
Thanks so much.

I've contacted my host and they seem to understand what is going on, but to get it fixed they had to escalate it. They tell me It should be fixed shortly. I will let you know.

Re: Can't update my profile

Posted: Thu May 30, 2019 4:06 pm
by lavalamp213
Well, still not fixed. I have provided them with the info to recreate the problem and now they just wrote me this:
Thank you for providing us detailed replication steps, but due to your CMS being one we normally do not provide support for we do not have access to your admin page to attempt to replicate.

We will need you to create us a admin user so we may log into your site and resolve this mod security error. Please respond to this case with the username and password of the account.
Here is the deal. This problem will not replicate if I do this.

I have a member (Zeri) that I use for testing purposes. I just made Zeri an admin. Then I logged out as myself, and logged in as Zeri. Zeri does not get the error messages when performing this function that I am getting when I am logged in as myself.

This problem seems to be tied for some reason to my identity. As the forum owner and founder, this seems odd.

As far as I can tell, no other administrative function is affected. Just my own ability to change my profile.

I guess I could give my provider MY login and password, but I am really reluctant to do that.

Do you have any insight or suggestions?

Re: Can't update my profile

Posted: Thu May 30, 2019 4:20 pm
by EA117
lavalamp213 wrote:
Thu May 30, 2019 4:06 pm
I have a member (Zeri) that I use for testing purposes. I just made Zeri an admin. Then I logged out as myself, and logged in as Zeri. Zeri does not get the error messages when performing this function that I am getting when I am logged in as myself.
The mod_security issue can be triggering based on something that is currently in the profile, and wasn't an issue when originally submitted, but is an issue now with the mod_security settings that are in place now.

For example, one such case was simply because "http://" appeared in the prefix of one of the values in the profile, which is "exactly what is supposed to be there" from a phpBB perspective (e.g. for a web site field in your profile), but mod_security was set to not allow for this. You said you were trying to add a web site address when you encountered the issue, but is there maybe already a web site address (or some other kind of unique information) already saved in your profile currently which mod_security is reacting to "even when you're just re-submitting the same information that is already currently saved there."

Which is to say you may need to replicate some of the "personal" information from your profile into the test account profile, in order to see the same results. The issue may not be with "any attempt to update the profile", but more specifically "an attempt to update the profile when it contains specifically the information your profile currently contains."

As such it may not even require an admin account to actually replicate the issue, but maybe they're requesting the admin access for a different reason.

Re: Can't update my profile

Posted: Thu May 30, 2019 4:27 pm
by stevemaury
I think you need to delete everything from your profile, after making a copy of the data, and add back one item at a time, testing after each.