Forbidden Error... :(

[Greyias]

I'm really excited about using this MOD, as it's something I've been wanting to do with my forum for a while. Although some of the options I'm not too fond of, so I've been trying to edit/delete some, but I keep getting this error when I try to edit or delete an item:


Forbidden
You don't have permission to access /candy/index.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.


I can add items just fine, but not edit. I'll keep messing around to try and figure out the ins and outs of it, AWESOME mod, thanks for making it Dan!

Edited to add: I used the fix install that was stickied, if that makes any difference. I'm sure it's my forum permissions, but they perplex me. Do I need to chmod certain files or folders to 777?

Edited one more time to add: Tried buying an item last night and got the same error too :/

Thanks! 

[Daniel15]

Can you please post your forum's address here? I'll see if I can find out what the problem is.

[Greyias]

Thanks Daniel.

It's at http://www.lupous.net/candy

It's (sort of) hidden on the SMF Default Theme, while the rest of the forum is displayed on a little offshoot of it. I checked all of the permissions, and both the directory and index file are 777, so I don't think that's the problem...

[Daniel15]

OK, I signed up under the username of 'Daniel15'...
Can you give me some credits so I can test the shop?

[Greyias]

All right, I gave you 200 in pocket and 50 in the bank. That should be enough for a little shopping spree

[Daniel15]

Erm... That error is really weird! I have no idea what is causing that!
Maybe another member can help? I'm completely stumped.

[Greyias]

This error was plaguing some of my members when they first logged onto the site (it was after an upgrade that I had done manually... because I hadn't quite figured out the package server yet), but it's disappeared until now. I'm not sure an uninstall/reinstall would work, but I could give it a try.

I haven't really looked at the code, but is there any reason it should be trying to access the index page?

[Greyias]

Hey Dan (sorry, I'm bumping this again and asking the same question), but is there a part of the file that's calling for the index?

I'm trying to figure out how to get rid of this darn error. The permissions seem to check out, but is there a particular way they're configured on your server that I may be overlooking? (I'm pretty sure everything is 777, but something could've gotten by me)

[Daniel15]

but is there a part of the file that's calling for the index?

Well, everything passes through the index.php file. If you look at any URL used by SMF, it will be like index.php?action=.........

Again, I'm really sorry, but this has just confused me. I don't know what to do to fix it

[Greyias]

Well... I did a little research on 403's, and found that they're mostly server concerned. With that information I went to my server, and I said, "Hey! You! What's up?", actually... I explained everything in detail and they came back pretty quick with this:

" It appears that a security mechanism that is inplace on the server is causing this error due to the fact that ;id=1 appears in the URL.  There are many PHP related attacks which are carried out through arbitrary code injections and the URL being called by the script in some places fits the common criteria for these attacks."

Which you know, explains why no one else seems to be having the problem.

When I was looking at the code earlier I know the part they don't like is something used throughout the script, so I'm guessing it's something I'd have to do for my forum individually. Is there any way I could change it to something else so that I could still use it? I'm really in love with this mod, the more and more I try to get it to work, funnily enough...

[Greyias]

One more update on me and my strange server problems. I found a temporary fix so I can meddle with the shop files and such, although since my server will likely get mad at me for messing with their hacker protection, I probably should fix the code so it's the mod_security approved i the near future.

I'm a little, brand new, to coding, so I'm not sure if it's possible. From what it sounds like from the server people, the hacker protection software doesn't like the id string in the URL line. Is there an easy way for me to fix that, or am I going to need extensive php knowledge to work around it?

[Daniel15]

Bah... mod_security is stupid Other than rewriting the code so that 'id' isn't used as a GET variable, I can't think of a way to work around it...

I guess you could try opening the Sources/shop/Shop.php file, and changing all instances of $_GET['id'] to $_GET['bla'], and all references of ;id= to ;bla=, but I haven't tested that, and it may or may not work. Just open the file, and do a 'Find and Replace'...

[Greyias]

Well I've made a temporary fix, messing with a htaccess file. I'll try coding it different, perhaps on a test forum The fix is working for now though.

[Daniel15]

Well I've made a temporary fix, messing with a htaccess file. I'll try coding it different, perhaps on a test forum The fix is working for now though.

Oh right, I should  have thought of that