Hello there, I'm the tech support/maintenance guy at http://www.golden-road.net, a Price Is Right fansite, and a user has stumbled across a problem that even has me stumped.

First, the important info that you should know.....

Xoops Version: 2.2.4
CBB version: 3.05 (if IE7 won't crash on me when I try to download the new version, 3.07, I'd have it installed on the test system we've got for testing upgrades and get ready to upgrade it on the live site if all works well)
PHP version: 4.4.2
MySQL version: 4.1.21

Here's the lowdown....

A member posted in the technical support forum at http://www.golden-road.net complaining that he could not post in the "Talk Is Right" forum, however, he was able to post in every other forum (including tech support).

This is a very recent problem.....he hasn't had the problem until around the 12th, and it suddenly started happening to him.

Here's the link to the thread for your reference (including any possible suggestions I offered the user): http://www.golden-road.net/modules/newbb/viewtopic.php?topic_id=1622&forum=16

Would anyone know what on earth is going on and/or what I can do to fix his problem? As I said, this problem even has me stumped, and I've used XOOPS (and converted http://www.golden-road.net from PHP Nuke to Xoops, which took over 3 months to do) for several years.

Thank you so much in advance!

Are there any clues in log files ...?
If this is apache, do you have mod_sec?

I looked at the log and saw nothing out of the ordinary.

I did ask the site owner to contact his web host and ask if they have mod_security installed.

I'll reply back when I find out that info.

You may need to set up error loging (for web server) level if it is turned off or increase the level. Same for mod_sec if it is installed. They may have diferent error log files also, so you will need to check both.

I need to be a lil' more clear on something.....I only have access to the last 300 messages in the error log (all lines were from the 15th). That may be why I saw nothing out of the ordinary.

In addition, I couldn't get much of the raw log because it's so huge in size and I'm on dial-up......what I was able to get downloaded in about an hour showed nothing out of the ordinary (probably because it was stuff from way before the 12th). (Edit: In fact, everything that I was able to get downloaded in an hour, over 5MB worth, was all from May 17th X_X)

I don't have access to every lil' thing on the web server (because we're on shared hosting, not on a dedicated server -- if we had our own server or on a host that would allow SSH access, I'd be in SSH looking at the raw log and hopefully more of the error log by now ), unfortunately.

The site owner couldn't reach the host last night over IM, so he's sending an e-mail to them. Hopefully we'll have an answer whether or not the host has mod_sec today.

Just an update to what's going on.....

The site owner hasn't received a response from his host (shame shame on the host's support staff) concerning mod_security. I tried e-mailing the host myself and haven't gotten an answer yet. Don't know if it's because it's the weekend or not.

The user in question is now able to post in Talk Is Right again. This leads me to believe that something I searched for before posting this problem may be it.....I suspect mod_security is installed and he posted something with a word or series of words that set it off and gave him the forbidden error.

If that is the problem and mod_security is installed.....what should the site owner ask the host to do for him?

Thanks a bunch!

Quote:

Well, first it is good to be shure. mod_sec has a logging setings as to where to log and what - the best way will be to set it to full log and try to repeat the error. You can aslo disable different rules and see where the problem is.

It may also be set to return other page(not 403).

However, all of this should be done by admin of the box (but you have problem reaching them)so in you case will be hard ...

It is good to have mod_sec - some extra security helps

To test it without the help of the hosting company when user has a problem, advise him to try to ppost simple test message - subj: test, text: test or something loke this. It may be a browser, cookie or something else...