MyBB Community Forums

Hi,

I'm a victim of mod_security2

PHP Version 5.2.6
Apache 2

I have performed all steps in the MyBB Wiki Help:Mod security

The error I receive:

Quote:Forbidden

You don't have permission to access /mybb/admin/index.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

This happens only on links ending with; /something:

mydomain.com/mybb/admin/index.php?module=home/version_check

After 2.5 days my host replies:

Quote:Hi

Please contact the developers/programmers of your script/module as it is a SECURITY Breach/issue and that is why you're getting errors.

This means that your script is open to attacks/exploits and must be "PATCHED" immediately by developer/programmer to resolve bugs or security holes and then itw ill run fine.

Any suggestions on what to tell them next? I'm not very interested in changing hosts. I have many websites and it's just over a year since last move.

Thanks

Burn

It's nothing to do with MyBB, they have to disable it.

Tell your hosts to stop being preposterous

There isn't any security issues with MyBB writing the URL in this way - it just matches mod_security's protocol. The only way around it is to ask your host to whitelist your domain against mod_security, and if they refuse, tell them that you agree that any implications will be your fault.

If they refuse totally, then I suggest you find a host that is more willing to give you a better service.

Who do you host with??

Hi Matt,

Thanks for your answer. My host is Cirtexhosting at cirtexhosting.com.

Burn

Well that looks like a very professional service... message them again and just ask them to remove it, and if they don't, I would highly recommend you change hosts. I can help you out with that if it comes to it, drop me a PM.

(2008-11-13, 09:31 AM)Matt_ Wrote: [ -> ]... message them again and just ask them to remove it...

They won't remove it as it protects their servers from a lot of problems...

As mentioned, ask them to whitelist your domain against mod_security. This fixes most of these problems - and all the hosts I've dealt with are happy to do it...

Well, that's what I meant

(2008-11-13, 10:17 AM)Tom.M Wrote: [ -> ]As mentioned, ask them to whitelist your domain against mod_security. This fixes most of these problems - and all the hosts I've dealt with are happy to do it...

I already did and the result is in my first post.

I'm not sure if they read all info i provided,so I'll try to talk to them again.

Burn

Please try this: upload to admin/index.php.

This should change the module separator from / to @, which hopefully works with mod_security. This is untested so some things may break (esp. with form submissions, I haven't been able to test everything).