I am experiencing a strange problem in one of my contributed modules. I have defined a callback using

$myaccess = user_access(...);
$items[] = array(
      'path' => 'mymodule/autocomplete',
      'callback' => 'mymodule_autocomplete',
      'access' => $myaccess,
      'type' => MENU_CALLBACK
    );

Everything works fine, except when I try to access the callback path with clean urls enabled (e.g. http://localhost/drupal5/mymodule/autocomplete) I am receiving an error 403 (access denied) message. However trying to access the callback using a non-clean url (e.g. http://localhost/drupal5/?q=mymodule/autocomplete) works perfectly. Regardless url rewrite is enabled or not non-clean urls work nicely as callback path, but I cant get this to work using a clean url (with rewrite enabled of course).
What I dont understand is that accessing e.g. user/autcomplete works in all cases.
The above code snippet is in if ($may_cache) { ... snippet ... }, but I also tried with !$may_cache.

Any ideas?

CommentFileSizeAuthor
#10 htaccess_d5.patch512 bytesthePanz
#8 htaccess_14_0.patch691 bytesprofix898
#4 htaccess_13.patch680 bytesTakafumi
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

greenmother’s picture

Title: 403 for callbacks with clean urls enabled » It seems I found it

Your "reptag" module conflict with row 6 in .htaccess and this have place only in Windows. I have a vague idea why is it so, but if remove |Tag| from this - all works right

<FilesMatch "(\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)|code-style\.pl|Entries.*|Repository|Root|Tag|Template)$">
greenmother’s picture

Title: It seems I found it » 403 in callback with clean urls enabled

oops, i accidentally change title, sorry

profix898’s picture

Component: menu system » other
Category: support » bug

I played a bit with .htaccess on my windows dev box and GreenMother is completely right. Nice catch :) The problem exists with all modules where the module name partially matches the FilesMatch list. What means e.g. template_module, anytag etc. doesnt work either.

Not sure how this can be fixed, but I'm making this a bug report to call developers attention to it.

Takafumi’s picture

Status: Active » Needs review
FileSize
680 bytes

This patch fix it. Please apply a patch and fix this issue.

ChrisKennedy’s picture

Is the FilesMatch string the full path or just the last part? I'm thinking that it's probably the full path, in which case your addition of ^ will prevent the second half of matches from ever being caught. Or am I wrong?

Takafumi’s picture

It works correctly. Please confirm it.

profix898’s picture

Version: 5.1 » 6.x-dev
Status: Needs review » Reviewed & tested by the community

Its still a problem in both 5.x and HEAD. Lets fix it at least for Drupal 6 (and maybe backport to 5.x afterwards)! The patch still applies and solves the problem. RTBC.

profix898’s picture

FileSize
691 bytes

Rerolled for latest HEAD. '.schema' was added to the list of protected files.

Gábor Hojtsy’s picture

Status: Reviewed & tested by the community » Fixed

Thanks, committed!

thePanz’s picture

Version: 6.x-dev » 5.2
Status: Fixed » Needs review
FileSize
512 bytes

I made a patch against .htacces of Drupal 5.2.. it works, but maybe need some review!

Bye

-thePanz-

drumm’s picture

Status: Needs review » Fixed

Committed to 5.x.

Anonymous’s picture

Status: Fixed » Closed (fixed)