Magento – 403 forbidden error while POST content – Nexcess server

magento-1.9Security

I'm running Magento latest version on Nexcess server.

I have created custom module to store template design in database. I'm using PHP code within textarea like,

<div> First Name: <?php echo $order->getFirstname?></div>

I'm using form Post method. When trying to save data It's throwing 403 Forbidden error. However when i'm adding same content to the CMS Block, CMS Page and transactional emails, it's working fine.

Note: I have changed all file permission to 644 and folder permission
to 755 except var (777) and media (777).

Apache mod_security extension is enabled on server. But why different
behaviour between CMS page and my custom module.

Best Answer

You may have triggered some Mod Security rules with your custom module.

Try checking your Mod Security logs or disable it and see if it works.

If it's confirmed to be caused by Mod Security, you can either identify the particular rule and disable it or change your codes to workaround the rule.

Related Solutions

Magento – File permissions changed after applying patch – 403 Forbidden Error!

While these permissions will get your site to work

find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod 550 mage

They are certainly not recommended for you to use such wide open permissions. Before you start changing permissions you should understand what you are changing and why. The above example gives a lot of privileges to all your files and folders.

You should experiment with your permissions and to keep them as restrictive as possible. For example, most of your files can run with 440 (You can test)

Note from Magento suggestions here http://devdocs.magento.com/guides/m1x/install/installer-privileges_after.html

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php

You see that you regular files are not writable at all, only your media and var folders. If you are on a shared server you may have to change the second bit to something other than "0"

If the above example does not work then you can try:

find . -type f -exec chmod 440 {} \;
find . -type d -exec chmod 550 {} \; 
find var/ -type f -exec chmod 640 {} \; 
find media/ -type f -exec chmod 640 {} \;
find var/ -type d -exec chmod 750 {} \; 
find media/ -type d -exec chmod 750 {} \;
chmod 750 includes
chmod 640 includes/config.php

It is important that you don't leave your site wide open to the world!

Magento 1.9 – Fix 403 Error for Admin Images and JS

You should only use 755 for directories and 644 for files (they don't need the executable permission).

Use these commands in the skin directory to apply the permissions recursively:

find . -type f -exec chmod 644 {} ;
find . -type d -exec chmod 755 {} ;

The first line finds all files and chmods them to 644, the second line finds all directories and chmods them to 755.

Best Answer

Related Solutions

Magento – File permissions changed after applying patch – 403 Forbidden Error!

Magento 1.9 – Fix 403 Error for Admin Images and JS

Related Topic