3

My server is Linux server and reseller is mine. So i can reach WHM panel, too .

When GET data comes like :

a.php?url=http://www.domain.com

return 403 Forbidden.

But if data comes like this :

a.php?url=www.domain.com

it's working.

So, http:// generating an error. How can i fix it ?

Also, this is returning 403 Forbidden :

a.php?url=http%3a%2f%2fwww.domain.com

Thanks.

Eray
  • 7,038
  • 16
  • 70
  • 120
  • Where does the data come from? Are you typing this into the browser? Do you have access to the error log to see which resource exactly access was denied to? – Pekka Feb 09 '11 at 22:01
  • there isn't anything on error_log . Doesn't mather , when i typing into the browser or sending via a form. – Eray Feb 09 '11 at 22:02
  • What's showing up in the error log? Something like mod_security could be actively denying access if it detects a URL embedded inside the request's URL (e.g. trying to prevent a potential XSS attack). – Marc B Feb 09 '11 at 22:11
  • error_log file (Which plaved to root directory) is empty. – Eray Feb 09 '11 at 22:12

4 Answers4

5

This is definitely one of the mod_security CoreRules. I've had the very same issue on my previous host. I don't remember the rule name however.

You should investigate the core rules version. 2.1.1 would be current, and might have relaxed that peculiar filter. If updating or reconfiguring doesn't help you would else have to base64_encode() your url parameter (simpler encodings are sniffed by mod_security).

SecFilterDebugLog /var/log/apache2/modsec_log
SecFilterDebugLevel 4

Enables the debug logging of mod_security, so you can find out which rule actually caused the issue - if you want to disable it (advisable). http://www.modsecurity.org/documentation/modsecurity-apache/1.9.3/modsecurity-manual.html#07-logging

mario
  • 144,265
  • 20
  • 237
  • 291
  • Eray: If none of the answers helps, flag your question for moderator attention and have it transferred to http://serverfault.com/ - they should know... – mario Feb 15 '11 at 03:12
0

You need to encode the query string so that it is valid, see urlencode()

jeroen
  • 91,079
  • 21
  • 114
  • 132
0

re: 404 -- perhaps you're rewriting the query string to the path somewhere, and you don't have AllowEncodedSlashes on?

covener
  • 17,402
  • 2
  • 31
  • 45
0

It is mod_security's 10_asl_rules.conf causing this error.

It is the .htaccess is picking up on something in that URL and sending forbidden headers.

Ashfak Balooch
  • 1,879
  • 4
  • 18
  • 30