Re: Don't have permission

  • Posts: 14
  • Thank you received: 0
12 years 3 months ago #60617

Hi,

I have the same problem.

I have set up a test site with Joomla 2.5.6 stable, Hikashop Business v. 1.5.8, HikaSerial 1.3.0, Falang V1.1.6 (basic), Community Builder v1.8.1 and JCE 2.2.2.

Everything works fine in Joomla and all other extensions. The only problem I have is that I cannot save Hikashop configuration. When I try to save changes i get this message:

Forbidden

You don't have permission to access /sites/cw42.no/administrator/index.php on this server.

Here are the permissions for this file:
-rw-r

1 michaelbentsen michaelbentsen 1.5K Jun 19 16:09 administrator/index.php

What can be wrong?
Update: The problem seems to be with mod_security. I got the error from the mod_security log file from my hosting partner, see attachment.

Attachments:
Last edit: 12 years 3 months ago by michaelbentsen. Reason: New info

Please Log in or Create an account to join the conversation.

  • Posts: 13201
  • Thank you received: 2322
12 years 3 months ago #60647

Hi michaelbentsen,

It seems to be due to mod_security, maybe mod_security block the size of the POST.
When you save the HikaShop configuration, much data are passed in POST, and it's possible that mod_security detect that as a security fail.

Try to configure it to allow more data.

Please Log in or Create an account to join the conversation.

  • Posts: 14
  • Thank you received: 0
12 years 3 months ago #60658

I cannot configure mod_security as it is set up by my hosting partner.

They will not change mod_security settings if I cannot make a strong argument and tell them exactly why they should do that.

They did some investigation, and the guy I was in contact with saw the following potential problems:

* No specification of the content transfer coding ( www.ietf.org/rfc/rfc2388.txt part 4.5)
* Too much content in one line (max 1024 characters on each line)
* May contain invalid characters (eg. = )

Here is a link to my hosting partners info page about their mod_security implementation/setup:
www.domainnameshop.com/faq.cgi?id=257&se...ion=a6b9acb5f536e0cd

The rule that is triggered is MULTIPART_INVALID_QUOTING.

Since I've never had this problem with any other Joomla page or extension, I assume that the error is related to how HikaShop is posting the config form or the size of the form data.

I also did a fresh install of the latest Joomla version with HikaShop 1.5.8 using english language only, but the problem persists (my other two sites which has this problem is in norwegian, but the fresh install did not have any norwegian characters).

Michael

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 3 months ago #60669

Hi,

Did you try to update your HikaShop configuration with several Internet Browsers ?
The error "MULTIPART_INVALID_QUOTING" came from your browser.
It send an invalid quote when it try to send the configuration in a multipart-post request.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 14
  • Thank you received: 0
12 years 3 months ago #60700

I do not think it is browser related.

All these browser give the 403 Forbidden result:

  • IE v9.0.8, both 32-bit and 64-bit version
  • Google Chrome 21.0.1180.79 m
  • Opera v 12.01 build 1532 x64

I don't know exactly when this error was introduced since I've been on vacation, but it may have been introduced with HikaShop 1.5.8 - although I doubt that too because I've tried a clean installed with Joomla 2.5.6 and Hikashop 1.5.7 and I still get the same error.

I will send you login to a test site where you can see the problem.

Michael

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 3 months ago #60709

Hi,

Thanks for the credentials.

I have update the "config | config" view in order to change the "enctype" of the form.
Without "enctype", the form use the default value : "application/x-www-form-urlencoded"

<form action="index.php?option=<?php echo HIKASHOP_COMPONENT ?>&amp;ctrl=config" method="post"  name="adminForm" id="adminForm">

But this enctype does not allow file upload so I have put a little javascript at the bottom of the page in order to have some "retrocompatibility".
<input type="checkbox" id="hikaform_chk" onchange="hikaform_set(this)"/><label for="hikaform_chk">Set multipart enctype (default value, for file upload compatibility)</label>
<script type="text/javascript">
function hikaform_set(el) {
  var d = document, f = d.getElementById('adminForm');
  if(f) {
    if(el.checked) {
      f.enctype = "multipart/form-data";
    } else {
      f.enctype = "";
    }
  }
}
</script>

By default the checkbox is unchecked and you can now save your configuration without having a "mod_security forbidden".

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 14
  • Thank you received: 0
12 years 3 months ago #60711

Worked like a charm! Thanks:)

Please Log in or Create an account to join the conversation.

  • Posts: 1
  • Thank you received: 0
12 years 2 months ago #62432

I have this problem to, could you tell me in wich file I have to make the change mentionen and add the scrypt that you share?

Thanks a lot!! :)

Please Log in or Create an account to join the conversation.

  • Posts: 82868
  • Thank you received: 13377
  • MODERATOR
12 years 2 months ago #62489

It's the file "config" of the view "config" as Jerome explained.
You can edit if via the menu Display->views. Make sure that you edit it for your back end template and not another template.

Please Log in or Create an account to join the conversation.

  • Posts: 14
  • Thank you received: 0
12 years 2 months ago #62566

Hi guys,

Just downloaded the new 1.6.0 release of HikaShop, and the problem has not been fixed.

Will you create a permanent fix for this problem?

It is triggered by MULTIPART_INVALID_QUOTING check in Apaches mod_security, and it is not browser related. There is most likely an error in the extremely complex form used to submit configuration changes in HikaShop.

One solution could be to create a separate form for uploading the default image, maybe use a popup or an iframe. Then there is no need to use multipart/form-data on the main configuration form.

Hope you will look into this and make a permanent fix. I suspect that this error occured after my hosting partner updated their Apache and mod_security installation in May, and afaik they use the recommended settings for mod_security - at least for the relevant parts. Therefore I suspect that more people may experience this error in the future and you should really create a permanent fix sooner than later.

Michael

Please Log in or Create an account to join the conversation.

  • Posts: 82868
  • Thank you received: 13377
  • MODERATOR
12 years 2 months ago #62691

Indeed we didn't add that checkbox fix as it's not a proper way to deal with that.

We're not sure yet about what to do. So far you've been the only one with that problem so it seems more to be a problem related to your server configuration than something which has to be fixed by default in HikaShop.
The solution Jerome provided is a correct workaround and it's done as a view override so you can even update without loosing it. Also, that config view won't change much in the future so I don't see any issue with doing like that.

If more users have that problem in the future, we'll probably change the image upload.

Please Log in or Create an account to join the conversation.

  • Posts: 12
  • Thank you received: 0
12 years 2 months ago #65685

feel like an idiot i can see what i have to add in but cant work out what file im adding it to.

It's the file "config" of the view "config" as Jerome explained.
You can edit if via the menu Display->views. Make sure that you edit it for your back end template and not another template.


new to all this could you maybe help me out here :blush:

Please Log in or Create an account to join the conversation.

  • Posts: 12
  • Thank you received: 0
12 years 2 months ago #65687

actually found the file to edit and added the check box and still same error ?????? :(

Please Log in or Create an account to join the conversation.

  • Posts: 82868
  • Thank you received: 13377
  • MODERATOR
12 years 2 months ago #65690

Make sure that you change the enctype of the form as explained.
If you still have the problem, please contact your hosting company so that they can get you the log of the error like michaelbentsen did. It might possibly be another problem and in that case that fix wouldn't help and looking at the log would help us understand what is going on.

Please Log in or Create an account to join the conversation.

  • Posts: 72
  • Thank you received: 4
12 years 2 months ago #66215

Hi Jerome,

it seems that the club of "Forbidden" grows up gradually...
I just want to say that I have exactly the same problem - it comes up with the message "You don't have permission to access /administrator/index.php on this server" after I'm trying to save configuration.

Joomla 2.5.7 + Hikashop Essential (switched over from VirtueMart...)
host provider - the same as MichaelBentsen www.domainnameshop.com/faq.cgi?id=257&se...ion=a6b9acb5f536e0cd

I've tried to solve this the way Jerome said (well, I think so), but no result.
Actually I've got familiar with HTML coding just 3 weeks ago, when I decided to launch my site on my own, so up til now it went quite well with the help of this forum. But now I give up...

Jerome, can I send my credentials to you in order you sort out all this thing?
Thank you!

Last edit: 12 years 2 months ago by Batas.

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 2 months ago #66221

Hi,

You can me your credentials by private message and I would apply the patch for you.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 2 months ago #66234

Hi,

I have receive your credentials.
There was an error the first time with the view save (a JFTP error with "mkdir") but I finally save view override with the patch.

You can now save your configuration.

Best regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 72
  • Thank you received: 4
12 years 2 months ago #66243

Wow! It works!
I even can't find the right word to describe such wonderful customer service!
And great product as well!

no idea about Jerome's explanation :blink:
but one thing I know - a huge thanx to you, Jerome! :)

Please Log in or Create an account to join the conversation.

  • Posts: 61
  • Thank you received: 1
12 years 1 month ago #68369

I did exactly what was described by Jerome, but it don't work. I have still the same error when I try to save system -> emails -> one of the e-mail template.

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
12 years 1 month ago #68440

Hi,

The email view is different than the configuration view.
Please edit the view "email | form" and remove the

enctype="multipart/form-data"
from the line
<form action="index.php?option=<?php echo HIKASHOP_COMPONENT ?>" method="post"  name="adminForm" id="adminForm" enctype="multipart/form-data">

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

Time to create page: 0.134 seconds
Powered by Kunena Forum