0

Currently, the request ends with Forbidden error when having a querystring parameter value that looks like an SQL command (for instance if it contains ' and and):

domain.com/path/to/page?foo=a%27%20or%20%27a

Instead, this should be a valid url that should open the page. I think the issue should be fixed in the .htaccess file. Currently the .htaccess looks like this:

# BEGIN s2Member GZIP exclusions
<IfModule rewrite_module>
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (^|\?|&)s2member_file_download\=.+ [OR]
RewriteCond %{QUERY_STRING} (^|\?|&)no-gzip\=1
RewriteRule .* - [E=no-gzip:1]

# Force Trailing Slash
RewriteCond %{REQUEST_URI} /+[^\.]+$
RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]

# Force Download Rule
<FilesMatch "\.(mp4|mp3|jpg|jpeg|pdf|png|tif|mobi|epub|azk)">
<If "%{QUERY_STRING} =~ /dl/">
ForceType application/octet-stream
Header set Content-disposition "attachment"
</If>
</FilesMatch>

</IfModule>
# END s2Member GZIP exclusions

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Somewhere we should whitelist these special characters such as %27 and special SQL keywords (such as and). Adding this line before the first RewriteCond line, didn't make any change:

RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]

(that was taken from this page)

How to solve this issue?

  • Try using the b switch. Let me get you back with the documentation link. – Praveen Kumar Purushothaman Nov 16 '16 at 9:33
  • @PraveenKumar What do you mean? Where should I add the b? – Ionică Bizău Nov 16 '16 at 9:36
  • Please have a look at this: httpd.apache.org/docs/current/rewrite/flags.html#flag_b – Praveen Kumar Purushothaman Nov 16 '16 at 9:39
  • @PraveenKumar No, it's not because of that... The url is already encoded, but it failes with a 403 when using SQL keywords and simple quotes. I'm not sure where these are set actually... – Ionică Bizău Nov 16 '16 at 10:01
  • I can't not reproduce your issue. I guess that the "Forbidden error" is a 403 HTTP status code, right? You may need to contact with your hosting provider. – cybmeta Nov 17 '16 at 8:45
1
+50

Looks like mod_security blocks your requests. To check it installed or not run <?php phpinfo(); ?> and check here: enter image description here

If so, you should contact your hosting provider or administrator.

  • I don't see any of these (I don't even see the apache2handler there). Also, cannot find on the page anything containing security or loaded modules. – Ionică Bizău Nov 20 '16 at 19:37
  • @IonicăBizău Could you confirm that you use apache? What version? And which SAPI for PHP ( php.net/manual/en/function.php-sapi-name.php ) do you use? – MaximOrlovsky Nov 20 '16 at 20:59
  • That's useful information. In this case, like you said, the hosting provider will take care of the issue. Thanks! – Ionică Bizău Nov 23 '16 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.