Add Listing 403 Error

This topic contains 13 replies, has 4 voices, and was last updated by  Paolo 8 years, 4 months ago.

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket

Tagged: 

  • Author
    Posts
  • December 27, 2015 at 6:15 pm #65452

    golocal
    Expired Member
    Post count: 7

    Hi,
    I have the exact same problem on my site farm described in this GeoDirectory support thread:https://wpgeodirectory.com/support/search/?bbp_search=add+listing+403+error. Specifically, the Add Listing page redirects logged out users to a 403 page and nothing I have tried will make it work again. I am not 100% certain, but I believe the redirects started last week after I upgraded the entire set of GD plugins.

    Just to be clear, when I’m logged out and navigate to the ‘Add Listing’ page I don’t get redirected to the login page with the sign in and register forms, but get a 403 error instead. When logged in I get the correct Add Listing form.

    Additionally, if I visit http://sitename.com/gd-login/ directly without being logged in, I can access the page. However, if I try to access the Add a Listing Page from the menu AND I am NOT logged in I am redirected to this url, http://sitename.com/gd-login/?redirect_add_listing=http%3A%2F%2Fsitename.golocal.directory%2Fadd-listing%2F%3Flisting_type%3Dgd_place, which throws a 403 error. It’s this query string that returns the 403. I have checked my hosting cpanel and can’t find any redirects setup on the server side and it seems like the GD plugin is inserting or creating this redirect for non-logged in users. The link in the main menu is automatically created by the GD plugin in its cpanel via this path: GeoDirectory/Design/Navigation.

    Manually adding a link to the login page in the TOP menu of the site allows non-logged in users to access the GD login page, but I am unable to add a link to the ADD PLACE/LISTING page (which would actually fix the issue for me). It seems like the plugin prevents adding a direct link to the page in menu, which seems logical as only logged in users should be able to add places. I think.

    I have tried disabling the plugins that are not provided by GD without results.

    Please advise. Any help is greatly appreciated.

    Thanks.

    December 27, 2015 at 6:20 pm #65453

    golocal
    Expired Member
    Post count: 7
    This reply has been marked as private.
    December 28, 2015 at 12:04 am #65468

    Guust
    Moderator
    Post count: 29970

    I cannot login to WP admin with those credentials.

    December 28, 2015 at 12:17 am #65473

    golocal
    Expired Member
    Post count: 7
    This reply has been marked as private.
    December 28, 2015 at 5:20 pm #65539

    Paolo
    Site Admin
    Post count: 31206

    Hi,

    that is most likely a server security setting.

    Some servers have problems with their own url being in the query string.

    Only way to really tell is to check server logs

    Please ask for assistance with this to your server admin.

    Let us know how you went,

    Thanks

    December 29, 2015 at 5:00 pm #65691

    golocal
    Expired Member
    Post count: 7

    Hi again,
    I have checked every log I can find on the hosting cpanel and nothing indicates or describes this error. The only error I can find in the logs that occurred recently relates to WordFence, but the problem remains even after disabling WordFence.
    I have submitted a ticket with my hosting provider. However, to save time once they respond, is there anything I should specifically ask for? For example, does the GD plugin require a certain Perl module, or a specific setting in php.ini, etc.? In other words, do you have a list that indicates all the standard server settings the plugin requires? For example, php memory should be 128M, the ABC Perl Module must be installed, etc.
    Lastly, is there a way I can manually edit where the claim a listing, and the add new listing/event links point to?
    Thanks again

    December 29, 2015 at 5:28 pm #65700

    golocal
    Expired Member
    Post count: 7
    This reply has been marked as private.
    December 29, 2015 at 7:10 pm #65728

    Paolo
    Site Admin
    Post count: 31206

    HI,

    please zip the error log or the system will not permit to upload it.

    You should ask to your server support, why a query string with the website URL is resulting in a 403 error.

    They should know what it is as it is not the case in 99% of servers.

    Thanks

    December 29, 2015 at 7:37 pm #65735

    golocal
    Expired Member
    Post count: 7
    This reply has been marked as private.
    December 30, 2015 at 7:38 pm #65974

    golocal
    Expired Member
    Post count: 7

    I can confirm that issues with URL formation throwing 403 Errors is a known issue with Hostgator, which is where these sites reside. HG seems to have pretty draconian implementation of mod_security rules. I have submitted a ticket and will update after the server wizards have a look. The fix may be as simple as getting HG to whitelist the domains.
    For anyone else with this problem see the following for reference:
    http://forums.hostgator.com/403-forbidden-error-t70181.html
    http://forums.hostgator.com/mod-security-and-403-errors-t71394.html
    http://www.codingforums.com/showthread.php?t=233958
    http://www.codingforums.com/showthread.php?t=244525
    http://www.jigsolving.com/general/ending-url-query-string-equals-symbol-can-cause-http-403-forbidden
    https://www.webmasterworld.com/apache/4163920.htm
    Incidentally, apparently this error is known but rare.
    I will update this post when HG resolves the problem so other users will have a reference to consult to help resolve similar issues.
    Thanks again.

    December 30, 2015 at 9:22 pm #65982

    golocal
    Expired Member
    Post count: 7

    This issue was resolved by the webhost modifying a mod_sec rule. Everything works now.
    Anyone else experiencing 403 errors please refer to my last post.
    Thanks.
    This ticket can be closed.

    December 31, 2015 at 12:52 am #65995

    Guust
    Moderator
    Post count: 29970

    Thanks for letting us know.

    December 31, 2015 at 3:32 pm #66062

    pstewart19
    Free User
    Post count: 8

    Thanks for posting this – I run my web servers under Plesk with some pretty strong security rules applied. One of those rulesets in ModSecurity utilizes Atomic WAF rules to protect against cross site scripting:

    [Thu Dec 31 10:14:43 2015] [error] [client xxx:xxx:cad:d0::1:1] ModSecurity: Access denied with code 403 (phase 2). Pattern match “(?:< ?script|(?:<|< ?/)(?:(?:java|vb)script|about|applet|activex|chrome)|< ?/?i?frame|\\%env)” at ARGS:geodir_video. [file “/etc/apache2/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf”] [line “298”] [id “340147”] [rev “134”] [msg “Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Potential Cross Site Scripting Attack”] [data “<iframe”] [severity “CRITICAL”] [hostname “xxxxxx”] [uri “/listing-preview/”] [unique_id “VoVGYn8AAQEAAG22a24AAAAA”]

    Just wanted to pass this along in case others come across it – I just need to update the rules now that I know where to look. thanks!

    Paul

    December 31, 2015 at 4:22 pm #66065

    Paolo
    Site Admin
    Post count: 31206

    Thank you for letting us know! 🙂

  • Author
    Posts
Viewing 14 posts - 1 through 14 (of 14 total)

We have moved to a support ticketing system and our forums are now closed.

Open Support Ticket