Hi,

CLEAN URLS:
I tried it with 'Clean URLS" both ON and OFF. Same Result

PERMISSIONS:
Does not seem to be permissions as it finds all the files.
I went as fas as setting permissions to 777 from css folder down to all files within.

NOTES:
I am using a Varnish reverse proxy:
I have tried it both ways: 1) thru Varnish and 2) using port 8080 to go around Varnish

Platform:
CentOS 6.5
Apache
MySQL
Varnish
Drupal 7.26

I also:
1) turned off the Google Page Speed and restarted Apache.
2) turned off the CSS files caching and aggregation on dev/performance
3) I flushed the CSS cache with DRUSH

I attached the NET console from firebug.

Thank you.

Respectfully,

Patrick O'Leary

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

deryck.henson’s picture

Have you installed the Varnish Module?

In addition, check your VCL against this code (retrieved from here).

sub vcl_recv {
  // Remove has_js and Google Analytics __* cookies.
  set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js)=[^;]*", "");
  // Remove a ";" prefix, if present.
  set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
  // Remove empty cookies.
  if (req.http.Cookie ~ "^\s*$") {
    unset req.http.Cookie;
  }

  // Cache all requests by default, overriding the
  // standard Varnish behavior.
  // if (req.request == "GET" || req.request == "HEAD") {
  //   return (lookup);
  // }
}

sub vcl_hash {
  if (req.http.Cookie) {
    set req.hash += req.http.Cookie;
  }
}

The main thing that changed that is likely to be causing this for you is when I patched a security hole that allowed anyone to access the /css/save path and POST/GET anything they wanted. It now verifies your user permissions against the 'edit css'.

If your site is www.social.net, I tested against opening /css/save and it did not give me the necessary error message (aka - 'Access Denied').

pmol123’s picture

Yes, the varnish module is installed.

However, please note that it also failed when I went around the varnish cache directly to the apache port with http://www.social.net:8080. I generally develop on port 8080 to eliminate any varnish issues.

Perhaps an option to have a list of IPs that are allowed to have the the "Edit CSS" JavaScript loaded. I did this with CSS_Watch a long time ago.

I will check the Varnish VCL file with your suggestion.

I uploaded the screen shot of the varnish config screen

Respectfully

Patrick

pmol123’s picture

FileSize
130.8 KB
deryck.henson’s picture

Post your .htaccess and a copy of your Status Report page (shouldn't be anything security-compromising but do a once-over before submitting here). Also, a screenshot of the Live CSS editor with the file list opened would be useful as well.

pmol123’s picture

Ok, the "sub vcl_hash" cause an error and varnish would not start.

I will upload the screen shots your requested.

Patrick

pmol123’s picture

FileSize
210.69 KB
pmol123’s picture

Drupal Status: All Green :)

root@www d7]# cat .htaccess
#
# Apache/PHP/Drupal settings:
#

# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
</FilesMatch>

# Don't show directory listings for URLs which map to a directory.
Options -Indexes

# Follow symbolic links in this directory.
Options +FollowSymLinks

# Make Drupal handle any 404 errors.
ErrorDocument 404 /index.php

# Set the default handler.
DirectoryIndex index.php index.html index.htm

# Override PHP settings that cannot be changed at runtime. See
# sites/default/default.settings.php and drupal_environment_initialize() in
# includes/bootstrap.inc for settings that can be changed at runtime.

# PHP 5, Apache 1 and 2.
<IfModule mod_php5.c>
  php_flag magic_quotes_gpc                 off
  php_flag magic_quotes_sybase              off
  php_flag register_globals                 off
  php_flag session.auto_start               off
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_flag mbstring.encoding_translation    off
</IfModule>

# Requires mod_expires to be enabled.
<IfModule mod_expires.c>
  # Enable expirations.
  ExpiresActive On

  # Cache all files for 2 weeks after access (A).
  ExpiresDefault A1209600

  <FilesMatch \.php$>
    # Do not allow PHP scripts to be cached unless they explicitly send cache
    # headers themselves. Otherwise all scripts would have to overwrite the
    # headers set by mod_expires if they want another caching behavior. This may
    # fail if an error occurs early in the bootstrap process, and it may cause
    # problems if a non-Drupal PHP file is installed in a subdirectory.
    ExpiresActive Off
  </FilesMatch>
</IfModule>

# Various rewrite rules.
<IfModule mod_rewrite.c>
  RewriteEngine on

  # Set "protossl" to "s" if we were accessed via https://.  This is used later
  # if you enable "www." stripping or enforcement, in order to ensure that
  # you don't bounce between http and https.
  RewriteRule ^ - [E=protossl]
  RewriteCond %{HTTPS} on
  RewriteRule ^ - [E=protossl:s]

  # Make sure Authorization HTTP header is available to PHP
  # even when running as CGI or FastCGI.
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

  # Block access to "hidden" directories whose names begin with a period. This
  # includes directories used by version control systems such as Subversion or
  # Git to store control files. Files whose names begin with a period, as well
  # as the control files used by CVS, are protected by the FilesMatch directive
  # above.
  #
  # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is
  # not possible to block access to entire directories from .htaccess, because
  # <DirectoryMatch> is not allowed here.
  #
  # If you do not have mod_rewrite installed, you should remove these
  # directories from your webroot or otherwise protect them from being
  # downloaded.
  RewriteRule "(^|/)\." - [F]

  # If your site can be accessed both with and without the 'www.' prefix, you
  # can use one of the following settings to redirect users to your preferred
  # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:
  #
  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/... will be redirected to http://www.example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} .
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
  # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  #
  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/... will be redirected to http://example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]

  # Modify the RewriteBase if you are using Drupal in a subdirectory or in a
  # VirtualDocumentRoot and the rewrite rules are not working properly.
  # For example if your site is at http://example.com/drupal uncomment and
  # modify the following line:
  # RewriteBase /drupal
  #
  # If your site is running in a VirtualDocumentRoot at http://example.com/,
  # uncomment the following line:
  # RewriteBase /

  # Pass all requests not referring directly to files in the filesystem to
  # index.php. Clean URLs are handled in drupal_environment_initialize().
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^ index.php [L]

  # Rules to correctly serve gzip compressed CSS and JS files.
  # Requires both mod_rewrite and mod_headers to be enabled.
  <IfModule mod_headers.c>
    # Serve gzip compressed CSS files if they exist and the client accepts gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]

    # Serve gzip compressed JS files if they exist and the client accepts gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]

    # Serve correct content types, and prevent mod_deflate double gzip.
    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]

    <FilesMatch "(\.js\.gz|\.css\.gz)$">
      # Serve correct encoding type.
      Header set Content-Encoding gzip
      # Force proxies to cache gzipped & non-gzipped css/js files separately.
      Header append Vary Accept-Encoding
    </FilesMatch>
  </IfModule>
</IfModule>
[root@www d7]# 
pmol123’s picture

FileSize
1.27 MB
pmol123’s picture

OK, all the files are uploaded as you requested.

Let me know if you want the Varnish VCL file.

Thank you. :)

Respectfully,

Patrick

pmol123’s picture

Please note: The Varnish "sub_hash" code you gave me caused an error and varnish would not start.

Patrick

deryck.henson’s picture

Disable jQuery Update module, flush caches and report back.

I'll do some extra debugging over here while you do that.

deryck.henson’s picture

And add this to the VCL to avoid caching the path ever:

if (req.url ~ "^/css/save$" ||
req.url ~ "^/\?q=css/save$") {
    return (pass);
}

You can remove the previous VCL settings since they don't work for you.

pmol123’s picture

Mr Henson, you are amazing, I never would have been able to debug that!

I added the varnish code, disabled the jquery_update and flushed the caches and it worked.

Patrick

pmol123’s picture

OK,
I re-enabled:
1) query_update and set it to 1.8 (tested views too)
2) clean-urls

ALL WORKS QUITE WELL!!! THANK YOU!!!

Perhaps it would be good to put a big bold banner on the Drupal project page and site configuration page to tell developers to:
1) Disable Google Page Speed
2) Install the Varnish VCL code if using Varnish

It would be neat if there was a module to disable google page speed.

Respectfully,

Patrick O'Leary

deryck.henson’s picture

Assigned: Unassigned » deryck.henson
Status: Active » Closed (works as designed)

I would add something along those lines but I don't have access to edit the description here.

But yes, it would be nice. Not likely though, since it requires an Apache restart after disabling the mod entirely.

Glad it's working out for you. Let me know if you have any future problems.