Bug Error page

[leegreaves]

Had a couple of problems with this today. Done a couple of installs/uninstalls thinking that it may sort it but hasnt. Had one problem that I solved myself regarding the download path. I now have a second error which I cant seem to get past.

You don't have permission to access /VBulletin/vbdownloads.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Ive tried logging out/restarting pc and then logging back in to see if this helped - no solution
Also tried clearing cache in admincp - no luck either

Any ideas why this is happening?

 

[Dylan]

Did you check the module permissions?

 

[leegreaves]

Im assuming usergroups that are "highlighted" in the manage modules are allowed to perform that individual action?

If so then all modules are set with the permissions I want for each of my usergroups. After checking that they are all good, I am still getting the same error.

 

[Dylan]

I'd have to check and see then, that's really the only reason you'd get that error, if the permissions weren't setup right.

Could you please create and PM me with a temporary AdminCP account?

For security reasons, we recommend you create a new AdminCP account only for DBTech support, then disable or delete it after we have both confirmed the issue has been solved and there are no further issues. It should ideally be a temporary account created for us only. If we have created an account on your site already, you can optionally boost that account to Administrator and then de-admin this account once the issue has been solved.

If you use a .htaccess password protection for your AdminCP directory, it is recommended that you create a new authorised user for DBTech and remove this user once the issue has been solved.

Please test any temporary accounts you create to ensure that the AdminCP account can access the administrative controls for the product we are assisting you with.

Ensuring this is all in order before submitting the information will significantly speed up the process of assisting you. We will alert you via PM if there's any issues with the login information you have provided.

When sending the PM, for your security you should also un-tick the "Save a copy in my Sent Items folder" checkbox. When the access details have been received, we will delete the PM from our inbox. Ensuring you have not kept a copy of the PM reduces the risk of security breaches.

Thank you for helping us debug our products and allowing us to assist you, we appreciate it

 

[leegreaves]

just read post and will be creating account and will pm once it is setup

 

[Dylan]

I can access it as an admin? Is it users that can't access? I noticed the Global module is limited. That is needed to be able to see the downloads.

 

[leegreaves]

Even myself as as an adminstrator cant upload files. The account you have is set with admin rights.

Its not the fact that I cannot see the downloads area, which I can. Its the fact that after attempting to upload a file it fails with that error page.

 

[Dylan]

Ah ok I see it now. That is weird, that's not an internal downloads error. Is it shared hosting or your own server? Just curious what kind of security do you have on the server?

 

[leegreaves]

can you explain what you mean? If i understand correctly there are several websites that share the same IP address that I use if you resolve it so i think it is shared hosting. My previous forum software (SMF 2.0) had a download system but had no problems, so Im unsure why this error is happening right now

 

[Ozzy47]

Check to see if it's chmod 655 or 755. It could also be a mod_security thing or suhosin issue if it's not a permissions thing. In that case, you will need to tell your host what is happening and have them fix the mod_security settings.

 

[leegreaves]

is there any particular file i need to check for permissions? Do u mean the vbdownloads.php file?

 

[leegreaves]

vbdownloads.php is chmod 644

 

[leegreaves]

Just tried it with 655 and 755 but still no success

i have also just checked my php configuration and cannot find any mod_security settings.

Options asp_tags Allow ASP-style <% %> tags. Off
File Uploads file_uploads Whether to allow HTTP file uploads. On
Paths and Directories include_path Windows: "\path1;\path2" c:\php\includes" .:/usr/lib/php:/usr/local/lib/php
Resource Limits max_execution_time 90
Resource Limits max_input_time 180
Resource Limits memory_limit 128M
Data Handling register_globals You should do your best to write your scripts so that they do not require register_globals to be on; Using form variables as globals can easily lead to possible security problems, if the code is not very well thought of. Off
Language Options safe_mode Off
main session.save_path Argument passed to save_handler. In the case of files, this is the path where data files are stored. Note: Windows users have to change this variable in order to use PHP's session functions. As of PHP 4.0.1, you can define the path as: session.save_path = "N;/path" where N is an integer. Instead of storing all the session files in /path, what this will do is use subdirectories N-levels deep, and store the session data in those directories. This is useful if you or your OS have problems with lots of files in one directory, and is a more efficient layout for servers that handle lots of sessions. NOTE 1: PHP will not create this directory structure automatically. You can use the script in the ext/session dir for that purpose. NOTE 2: See the section on garbage collection below if you choose to use subdirectories for session storage /tmp
File Uploads upload_max_filesize Maximum allowed size for uploaded files. 200M

 

[Dylan]

you wouldn't find any settings in php for mod_security, it integrates with apache, not php. Can you try modifying your htaccess and adding this

<IfModule mod_security.c>
<Files vbdownloads.php>
SecFilterEngine Off
SecFilterScanPOST Off
</Files>
</IfModule>

If mod_security is there and blocking it, it should work. If it's not it shouldn't make a difference.

 

[leegreaves]

nope didnt work...same error still comes up...im stumped cos at some point im pretty sure it DID work but cant remember now

 

[Dylan]

Could I get FTP access to try and figure it out?

 

[leegreaves]

yes of course ill set up an FTP account for your use and PM u the details.

 

[Dylan]

It looks like your site is running on mod_security2. That version can't be disabled through .htaccess. I think you're going to have to talk to your host and see if there is a rule filtering posts on your site. It might have worked before because the host might have been on mod_security and upgraded in the meantime.

 

[leegreaves]

What would I need to ask them to do in order to allow VBDownloads lite to function properly for the site?

 

[leegreaves]

Ive just checked up on mod_security2 and it seems like as you said it cannot be disabled via .htacces. However, it CAN be disabled by the looks of it inside the virtual host of httpd.conf

Would you recommend that? Heres the link I came across in a google search

mod_security2 - how to disable it via .htaccess ?