Media shows 403 Forbidden

[svsanchez]

Hi,

I upgraded to WB 2.12.2 r379 but the media option in the admin stopped working: when I go to media, I get a 403 Forbidden error.

I tried upgrading to WB 2.13.5 to see if this would fix it, but not only it didn't, it also destroyed my template.

So, I restored my WB 2.12.2 site and have been uploading images via FTP, and directly accessing their URLs to copy and place them where I need.

How do I fix this?

The site is: https://www.caletaazul.com/admin/media/index.php

[hgs]

We need a little more information.
Which php version is used to run the website?
What did the “destruction” of the template look like?

Your link should redirect to the BackEnd login, but this does not happen.
You have placed a “protection” in front of the BE login, but if you only enter https://www.caletaazul.com/admin, the login window appears after a while

[sternchen8875]

if you ask me..... it's possible that someone hacked your webspace or we didn't know all about the problem

- normally it's not possible to access the files and folders in the admin directory directly as there is a protection in each file and if the condition is not met you get a redirect to the login screen

- it also looks like something is going wrong in the admin folder, maybe a redirect or foreign code. the original file in admin/index.php has only 7 lines of code, nothing can be done for this long waiting time

- I can call the file admin/media/index.php directly in the browser, this is normally not possible. It shows me that - at least - this file no longer has the original code

again... if you ask me... immediately replace the following folders with the original files from your used WB-Version
- account
- admin
- DOCU (if you have - its not needed from the WB-system, but not good, if there some changed files inside)
- framework
- include
- install
- languages
- search

and check the other files and folders. the wb-own-files are from 2019. if you found files with a newer filedate, be carefull

P.S.: if you need the original files, i can send it via email.

[sternchen8875]

i remember, that a lot of users working with different folder-protections for the admin-area / admin-directory, for example: .htaccess-protection, mod_rewrite or something like this. To locate your problem, deactivate this methods (if you use it) and work only with the original files

[svsanchez]

Hi HGS, to answer your questions:

PHP: I upgraded to PHP 7.2 when I upgraded from WB 2.8.3 to WB 2.12.2 about 2 years ago. Then yesterday I changed it to PHP 8.1 to upgrade to WB 2.13.5. After I restored the site to WB 2.12.2 I changed to PHP 7.4 and left it there.

"Destruction of the site": After upgrading, the site appeared with a different template, similar to the old WB 2.8.3 template but with red and some dots instead of the blue, although the site's template was completely modified.

Login Protection: this is placed by my hosting company (20i).

[svsanchez]

Hi Sternchen8875, thank you for your reply.

Since I was getting the 403 error, I started uploading the images via FTP, and then:

1) I renamed the index.php from the /media folder
2) I removed the Directory Indexing from the server, so that I could see the list of all the images and copy > paste them easily

Unfortunately something keeps preventing the directory listing from appearing. I asked my host and they said it seems like WB is preventing the directory from showing it's contents. They told me to check with WB to see if there's some htaccess needed to show the contents of the directory.

This is the content of my /media/index.php by the way:

<?php
// *** This file is generated by WebsiteBaker Ver.2.8.2
// *** Creation date: 2011-11-09T20:06:57+00:00
// *** Do not modify this file manually
// *** WB will rebuild this file from time to time!!
// *************************************************
   header('HTTP/1.1 301 Moved Permanently');
   header('Location: http://wb282.wdsnet/2.8.x/wb/index.php');
// *************************************************

[svsanchez]

Hi again Sternchen8875, I renamed the index file back to index.php.

If I go to https://www.caletaazul.com/admin/media/index.php I get a 403 Forbidden message.

If I go to https://www.caletaazul.com/admin/media/ I can see the admin media section with the upload buttons, but the right pane where the images should appear shows the 403 Forbidden message:



Other than renaming the index.php, I have not made any modifications.

[svsanchez]

I forgot to add:

After I upgraded to 2.13.5, I accessed the admin media section and had the exact same problem as with 2.12.2 (403 Forbidden) having uploaded all the new files from the 2.13.5 upgrade package.
 

[sternchen8875]

this is cool..... okay, not for you, sorry

to explain it... the index.php (in every folder under /admin/media) works as folder protection. if WB doesnt found this index.php, it build a new one - but your showed code is the code for other index.php, but not for this in /admin/media
the used link to wdsnet is the old test-domain from Dietmar, the Chief-developer, so there is no risk - (i'll check also the next version WB 2_13_6 for Links like this)

in the attachement the original admin/media/index.php

unzip this file and replace it

[svsanchez]

Hi Sternchen8875, thanks a lot for the file which made me realize that I sent the wrong index.php:

I sent the index.php for caletaazul.com/media/index.php which is the one which has the redirect to the old test-domain from Dietmar.

The index.php I have on caletaazul.com/admin/media/index.php apparently is the same (both my index.php and the one you sent start the same and both have 166 lines).

Anyways, I replaced my index.php with the one you sent, but when I click Media on the backend I still get the 403 Forbidden message 

[crnogorac081]

Enter your cpanel -> File manager and see permissions on /Media folder and files and folders inside it. It could be easily sunce you moved files that permissions Are messed up


There Is a module called fix permissions that worked on previous wb versions , it could fix things, but do not use it without testing and reviwing the code first

http://www.websitebakers.com/pages/tools/fix-permissions.php

[sternchen8875]

in addition to the tip from crnogorac081:
you can use also your ftp-program, to check or change the file-permissions
- all files has chmod 0644 or rw-r--r--
- all directories has chmod 755 or rwxr-xr-x

the folder content on the right side from the media-administration is inside of a iframe, maybe, thats the problem

some other iframes in the backend to test it:
 - filebrowser in ckeditor
 - iframe-plugin in ckeditor
 - captcha display in admintools/Captcha Spam-Protect  -> type of captcha



the wrapper module use the iframe in the frontend

do you use a .htaccess inside of the admin-directory or in admin/media?