Why am I getting a 403 error on a POST to a PHP script?
Posted
by John Gallagher
on Server Fault
See other posts from Server Fault
or by John Gallagher
Published on 2010-06-10T11:21:45Z
Indexed on
2010/06/10
11:24 UTC
Read the original article
Hit count: 360
Background
I want to allow my users to submit a crash report which will get emailed to me.
I'm using UKCrashReporter with the bundled PHP script I've modified. This code does a POST to a specified URL along with the crash report.
I'm on a shared server running Linux. My main domain is synapticmishap.co.uk.
The Problem
When I send the crash report off, on the Cocoa side, it reports as having sent it successfully, but I don't receive an email.
The code has been used in lots of other well established Cocoa projects and it was working for me a few months ago.
That leads me to conclude that the problems are related to my web server setup, something I know almost nothing about.
When I look at my log files, I see entries like this:
IP Redacted - - [10/Jun/2010:09:47:53 +0100] "POST /synapticmishap/crashreportform.php HTTP/1.1" 403 74 "-" "UKCrashReporter"
What I've tried
I've tried accessing the page at http://synapticmishap.co.uk/synapticmishap/crashreportform.php via a browser. It loads fine.
I've made sure the permissions on this php script are set so anyone can execute it.
I've tried removing the deny entries from the section of .htaccess at various levels starting with root.
I've downloaded the URLParams plugin for Firefox which allows you to simulate POSTs. I put in the URL above and tried a post with "crashlog" as the parameter and "test" as the value. This generated a 200 log entry in my log file - it seemed to work, although no mail message was sent.
Code
I've got the following at http://synapticmishap.co.uk/synapticmishap/crashreportform.php. I've simplified it to just the bare bones in an effort to get it working.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Crash Report</title>
</head>
<body>
<p>This page contains super special magic which submits a crash report item to me.</p>
<p>Nothing to see here - move along.</p>
<?php
mail( "[email protected]", "Crash Report", "\r\n\r\nThis is a test.");
?>
</body>
</html>
This is my top level .htaccess file:
RewriteEngine on
# -FrontPage-
IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*
<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
Options All -Indexes
RewriteCond %{HTTP_HOST} ^synapticmishap.co.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www.synapticmishap.co.uk$
RewriteCond %{HTTP_HOST} ^lapsusapp.co.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www.lapsusapp.co.uk$
RewriteRule ^/?$ "http\:\/\/synapticmishap\.co\.uk\/synapticmishap\/lapsuspromo\/" [R=301,L]
RewriteCond %{HTTP_HOST} ^jgtutoring.co.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www.jgtutoring.co.uk$
RewriteRule ^/?$ "http\:\/\/synapticmishap\.co\.uk\/tutoring" [R=301,L]
RewriteCond %{HTTP_HOST} ^synapticmishap.co.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www.synapticmishap.co.uk$
RewriteRule ^/?$ "http\:\/\/synapticmishap\.co\.uk\/synapticmishap" [R=301,L]
RewriteCond %{HTTP_HOST} ^jgediting.co.uk$ [OR]
RewriteCond %{HTTP_HOST} ^www.jgediting.co.uk$
RewriteRule ^/?$ "http\:\/\/synapticmishap\.co\.uk\/editing" [R=301,L]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://synapticmishap.co.uk/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://synapticmishap.co.uk$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.synapticmishap.co.uk/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.synapticmishap.co.uk$ [NC]
RewriteCond %{HTTP_REFERER} !^http://synapticmishap.co.uk/synapticmishap/crashreportform.php/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://synapticmishap.co.uk/synapticmishap/crashreportform.php$ [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]
Help!
I'm at the end of my tether with this and I'm in a very unfamiliar space with all this web stuff. I'd be most appreciative of any thoughts people had on why this isn't working. Thanks.
© Server Fault or respective owner
