By krisvlo on

Dear,

since at least six weeks I'm getting a 403 Forbidden error on post or preview for most node types (of course on the most relevant ones like a simple blog article).

Forbidden
You don't have permission to access /?q=node/add/aankondiging on this server.
tegenvoeters.be

I Googled this several times but only found very old posts or posts related to specific modules that I don't even use. And then there's the posts full of code which scare me. I have never modified any code on any component apart from some css tweaks two years ago. In fact, in most cases I don't even know where or how to apply suggested code fixes or hacks. On top, I absolutely prefer to keep my site clean from any code changes as I want to avoid issues later. Especially as my site has been stable for over a year.

Basically the only thing that changed since the last successful article post were standard module upgrades, drupal core upgrades (it started when on 7.35 -I don't think 7.35 introduced it- , I'm now on 7.37) and translation updates.

I contacted my hosting provider. They said the only thing they changed recently was some firewall settings but they claim they reverted those settings for my particular site tegenvoeters.be (private and in Dutch). They suggested it might be Drupal specific.

I personally doubt it is a drupal issue purely based on the fact that my site is pretty much all standard modules. Any issue I had before could be resolved easily by Googling or asking a specific question on this forum. Now I am totally stuck and need to make it this vague. I'm just hoping somebody has some idea that can point me in the right direction.

In case somebody would want to have a look at the site itself, I can provide you with an admin account to the site.

THANKS HEAPS, and apologies for the generic nature of my question.

Kris

⋅ Categories: Drupal 7.x

Comments

krisvlo’s picture

krisvlo commented

Please note I already rebuilt the permissions several times. Flushed all cashes and rebuilt permission etc. Nothing helped.

Kris

Stefan Lehmann’s picture

Stefan Lehmann commented

To me it sounds like a 403 thrown by Apache. You could verify that by adding:

print('Hello it\'s me, Drupal!');
die();

to the very head of your index.php. Back it up beforehand!

If you request any of these URL paths, which throw this error message and you don't see "Hello it's me, Drupal!" it means that Drupal isn't involved in generating those 403 messages. If that happens it's either something in the .htaccess or the webserver configuration.

Probably latter if you haven't changed any code lately.

If you see this message - the message is thrown / generated by something inside of Drupal - which might also lead you into the proper direction.

I like cookies!

krisvlo’s picture

krisvlo commented

Hi Stefan,

Thanks a lot for your quick suggestion. It seems you're assumption is spot on.

I added the lines to the files but then of course found that I can't open the site anymore as I always get the test message. So I then reverted back to the original index.php, browsed to the blog-item creation page, put back the test message in index.php and requested a preview for the post: I still get the 403!

So although this doesn't solve the problem, it does pretty much prove that this is indeed a webserver or .htaccess issue, so back to my hosting provider it is I guess.

Cheers!
kris

krisvlo’s picture

krisvlo commented

Hi Stefan,

thanks for your suggestion. It helped convince my hosting provider that it was very likely something on their side, and indeed. The "mod security" which they had put on the server some time ago was removed again and now it all works. The had already configured my side to bypass the "mod security" but that wasn't enough.

I guess they'll be looking into this further, but for me the issue is solved.

THANKS for you help!

kris