Problems with .htaccess support.

14 Jul 2016, 01:34

#1

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Problems with .htaccess support.

Not sure why I am getting this error. .htaccess files are in all directories except the main directory. And apache says deny everyone all files that start with .ht

So why am I getting this? I grabbed it from sourceforge with wget. I feel like I should wait before installing.

<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>

14 Jul 2016, 02:29

#2

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,506
Plugin Contributions:: 173

Re: Problems with .htaccess support.

If you're referring to zc_install telling you that it discovered problems with .htaccess support, you'll find that it is explained in more detail by clicking on that message.

One of the protections that the .htaccess rules provides is to deny access to certain files that normal visitors ought not to ever be able to access. So zc_install makes an external call to attempt to access some of those normally-forbidden files using CURL to simulate a rogue visitor. When the response to that is a "200 OK" instead of a "403 Forbidden" it reports back the "Problems with .htaccess" message.

It does this by attempting to access one of the /includes/xxxxxxxx.php files. If yours is allowing access to that file, then your .htaccess rules aren't working, and you'll need to adapt your Apache configuration to allow it.

You're free to proceed with installation as long as you don't care that your server is not preventing visitors from accessing parts of the ZC file structure that they shouldn't be able to.

14 Jun 2017, 14:51

#3

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

Its just the main directory where the access file is missing. I unzipped .e and there is no such file in the main directory.

15 Jun 2017, 00:11

#4

website_rob

Inactive

Join Date:: Oct 2006
Posts:: 4,572
Plugin Contributions:: 0

Re: Problems with .htaccess support.

See if this works for you.

public_html/.htaccess

<Files ".ht*">
Deny from all
Allow from localhost
</Files>

Also, a good idea to set 444 permissions on any/all .htaccess files. You just have to remember that to edit an .htaccess file change permissions to 644.

15 Jun 2017, 07:32

#5

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
Its just the main directory where the access file is missing. I unzipped .e and there is no such file in the main directory.

This is because with a default install, an .htaccess file isn't needed in the main directory (root folder). The .htaccess files in *other* folders are to prevent spiders/crawlers/hackers from accessing those folders (or certain files within those folders), but the root folder (for any site) should be 'open for all' (else there isn't really a point of running a website).

The .htaccess files themselves generally (and should always) have restricted access (IOW - 'deny from all'). The webserver itself can/will still be able to read these files, but people/bots/hackers can't.

If the *server* is unable to access the .htaccess file(s) they will be ignored. The only reason why a server would not be able to read them is if the folder or file *permissions* prevent it from doing so. It is *very* unlikely that the root folder would have unsuitable permissions else the site probably wouldn't be working at all, so problems in this regard will boil down to ownership/permissions of the .htaccess file(s) themselves.

Please keep in mind though, that the root folder doesn't need an .htaccess file (which is why none is supplied). You want the files in this folder to be readable by all, ergo, .htaccess not needed.

Hope this clarifies rather than confuses?

Cheers
RodG

15 Jun 2017, 11:19

#6

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

I just can't figure out why the install warned me about no htaccess. Apache is configured for default values.

Found this apache article very interesting

https://httpd.apache.org/docs/2.4/howto/htaccess.html

15 Jun 2017, 11:45

#7

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

So it looks like the apache 2.4 config file has allowoverides set to none, but vhost config has allowoverides set to all. So which has priority?

16 Jun 2017, 03:30

#8

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
So it looks like the apache 2.4 config file has allowoverides set to none, but vhost config has allowoverides set to all. So which has priority?

The vhost configs and the apache config are basically the same config in that all directives are read/set when the server starts.

When a server is 1st set up it only knows itself (vhosts dont exist) which is fine for a VPS and typically in this scenario the "default" apache settings would need to be changed from AllowOverrides none to AllowOverrides something.

A vhost is best considered as directory settings, each vhost having its own directory and document root that is different than the main server settings. In this scenario the main server is often treated as a "catchall placeholder" and only used to display an error type response along the lines of "the vhost you have requested doesnt exist on this server". This is generally a static page and Overrides arent needed, which is why it is typical for the allowoverrides to be none... for this default directory.
The vhosts (same config files) generally do need overides, so in the directory settings for those hosts you will find the allowoverides something. This enables each vhost owner the abilty to use settings based on their needs via the .htaccess files.

In other words, the apache defualt setting and the vhost setting for the allowoveride settings isnt a matter of which takes priority because they are both equal, it is the directory(s) that determine whether allowed or not.

A curiosity worth noting at this stage is that if the main config has allowoveride none it is not possible to use the .htaccess files to override this (pretty obvious), but if the main config file (which includes the vhost settings) have an allowoverride all, then it is possible for the vhost owner to override this with an allowoverride none.

So in summary, the default apache setting (default server) and the vhost settings have the same priority. The contents of the .htaccess files can be considered as having a higher priority in that these are read/used *after* the main server/vhost configs, but only if those same main configs are set to allow it.

If you find this confusing then I'd suggest you not even worry about it because unless running your own server you have no control over the main settings (to allowoverides or not) and your hosting provider would almost certainly have set this so that at least *some* overrides are possible for your vhosts via your .htaccess files.

Cheers
RodG

16 Jun 2017, 19:12

#9

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

I am running my own server on Linode.

The whole discussion started because everytime I install ZC it tells me that htaccess not supported even though the vhost config file allows overides. I just wanted to clear this error during install, thats all.

17 Jun 2017, 05:30

#10

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
ZC it tells me that htaccess not supported even though the vhost config file allows overides. I just wanted to clear this error during install, thats all.

Apologies, but I need to be a little pedantic here. Although the ZC message reads like "There is a problem with .htaccess support on your server" this is *not* the same as saying .htaccess is *not* supported" . The difference may be subtle, but I can assure you that .htaccess *is* supported, it is just that ZC has performed a test (for security purposes) and determined that is just isn't working for some reason.

IOW - Supported but not working.

One of the reasons for the ZC to report this message is if you don't have the supplied .htaccess file in the /includes/ folder (which AFAIK is the only test made). This can *easily* happen if uploading the files via FTP and these files remain 'hidden' (by default, any file with a name starting with a '.' is a 'hidden file on *nix systems (I dunno about Windows, but that's unimportant here), so the 1st thing to check is to see if /includes/.htaccess does actually exist.

You have told us that it doesn't exist in the main directory (doesn't need it there), but unless I missed it, you've not told us whether one exists in the /includes/ directory or not - So the solution to your problem (clear the error) could be as simple as uploading this missing file.

The allowoveride none directive will have the same effect as missing .htaccess files, but you have assured us that your vhost config allows it, so that is *not* going to be the cause of your problem. The allowoveride directive for the default server (not a vhost) doesn't even come into play. It is effectively a different 'host' entirely - and as I detailed earlier, this is typically set to 'none' because strictly speaking there is no need for it (it is better to simply set the needed directives in the main config).

Assuming the vhost allowoveride is set to 'all' and assuming the /includes/.htaccess file does actually exist, and assuming it is an unchanged copy of the .htaccess supplied by Zencart, and assuming it is readable by the server process, then you won't be having this problem. The fact that you *are* having the problem means that at least one of these assumptions is incorrect. Only you are in the position to identify which it actually is.

My money is on the /includes/.htaccess file doesn't exist (and if it doesn't, please check on the *other* ZC-supplied .htaccess files to ensure they aren't also missing), because without these files to prevent access to *restricted* folders you are opening yourself up to a bucketload of abuse)

Please don't ignore the ZC warning. You *can* complete the installation in spite of this, and even fix the problem *after* the install (assuming you remember to do so), but you really, *really* shouldn't - The ZC check ensures that all is good. Fixing it after the install means that you need to do your own manual testing to ensure it is working and the site is secured.

Cheers
RodG

17 Jun 2017, 12:19

#11

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

htaccess files exist in other directories and are not hidden.

Looks like I will have to allow overides in httpd.conf in addition to vhost.conf

17 Jun 2017, 16:49

#12

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
htaccess files exist in other directories and are not hidden.

Looks like I will have to allow overides in httpd.conf in addition to vhost.conf

That won't solve your problem.
Is there a reason that you failed to confirm whether /includes/.htaccess exists or not?

Also, I find it a bit disconcerting that you state that *other* .htacess files exist but they are not hidden because the "." in the filename is the *nix standard that defines a "hidden" file.

I'm seeking a solution to your problem. You appear to be defensive to my approach, so just two questions before moving on.
1. Does the file /includes/.htaccess on your server?
2. What are the permissions for this file (should be 644).

Cheers
RodG

17 Jun 2017, 23:08

#13

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

First sentence in my previous post answered the question that you said I didnt answer.

You didnt ask for the permissions originally, but yes they are all 644

When I say they are not hidden, I mean they are visable in my directory structure. Not using anything other than pure apache.

18 Jun 2017, 02:54

#14

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
First sentence in my previous post answered the question that you said I didnt answer.

Hmmm, well no you didn't, and still haven't. It may have been implied as part of the "other directories" but I'm not willing to make that assumption. Historically I've wasted many hours going around in circles due to this kind of thing. Seriously, the .htaccess files in "other" directories are unimportant to the problem. The only important one is the one in the /includes/ folder and I really didnt think it too much to ask that you verify/confirm that this specific one exists.

pixelpadre:

You didnt ask for the permissions originally, but yes they are all 644

No, I didnt ask previously which is why I asked this time. Could you please confirm that you actually checked that permissions are 644 and that this wasnt from memory or possibly you just said it was 644 because that is what I said it should be?

pixelpadre:

When I say they are not hidden, I mean they are visable in my directory structure. Not using anything other than pure apache.

Im not sure what you mean about "pure apache", and "hidden" in this context does not mean they can't be seen in the directories. All files in all directories can be seen, even the hidden ones.

Anyway, lets try to move forward eh?
So, the file /includes/.htaccess exists, and it has permissions of 644 .... Next step is to set the permissions to 666 (temporarily) and edit the file by adding the words "hello world" right at the beginning of the file. save it.
Now point your webbrowser to yourstore.com/includes/

One of three things will happen. When you tell me the results that you are getting I will either be able to give a diagnosis, or will I be able to provide you with the next diagnostic step(s).

Cheers
RodG

18 Jun 2017, 15:54

#15

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

internal server error 500 page

19 Jun 2017, 04:03

#16

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
internal server error 500 page

That's exactly what we want :)

What this is telling is us is that

1) Your allowoverrides are OK
2) The .htaccess file is in the correct location for purpose.
3) The .htaccess file is *currently* readable by the server process.
4) The .htaccess file is correctly named (Yes, I have seen cases where folk have renamed it for whatever reason and then wonder why it isn't working)

Next step. Same as b4, but leave the file permissions at 644. You should get the same 500 server error, so assuming you do - you should now remove the 'hello world' and resave the file.

FYI, The 'hello world' itself isn't important, pretty much any text that isn't recognized as valid syntax will cause the server 500 error. This is just a handy/useful trick/tip that will determine that the .htaccess file of interest is actually being used or not. If anything was amiss with those 4 points above, the file would be skipped and you'd be getting something *other* than the 500 server error.

So, now we know that all is good as far as finding and reading the .htaccess file you should now once again point your browser to

yourstore.com/includes/
While you are at it, also point it to
yourstore.com/includes/spiders.txt

If the *contents* of this .htaccess file are all correct, you *should* be greeted with a 'Forbidden' message for *both* tests. This is actually the response that the ZC installer is looking for - but since the problem you are having is failing this test that would imply that there is something not quite right with the contents of this file. This is what you'll need to investigate to seek a solution since all(?) other possibilities have been eliminated.

However, if you ARE getting all the expected results here - the plot thickens - We will no longer be looking at 'your' side of things - It means that for some reason or other the ZC installer is actually giving you a false report - I would even go as far to say just ignore it - The important thing at this stage is that *you* get the forbidden message when you point your browser to /includes/ and /includes/spiders.txt - After all, it is this that the ZC installer is testing for and if the installer is giving a false error report (which is where this is now headed) then there doesn't seem like there is anything that you can do to fix it anyway. Basically 'not your problem'

Cheers
Rod.

ps. I chose to use spiders.txt, the zc installer uses one of the .php files in the same folder. Both should be 'forbidden'

19 Jun 2017, 11:13

#17

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

We troubleshoot in the same methodical manner, very logical!

20 Jun 2017, 18:37

#18

pixelpadre

Suspended

Join Date:: Jun 2007
Posts:: 868
Plugin Contributions:: 0

Re: Problems with .htaccess support.

ok got the Forbidden error in both cases with 644

21 Jun 2017, 05:07

#19

rodg

Deceased

Join Date:: Jan 2007
Posts:: 6,263
Plugin Contributions:: 3

Re: Problems with .htaccess support.

pixelpadre:
ok got the Forbidden error in both cases with 644

Hmmm, so why would the ZC installer be failing these very same tests? DrByte, any ideas? 'cos I have none.

Cheers
RodG

21 Jun 2017, 14:11

#20

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,506
Plugin Contributions:: 173

Re: Problems with .htaccess support.

Feels like something unique to this server; others aren't complaining about it. I can't trigger it on my test servers that have a standard apache install and configured per our very basic guidelines.

Here's the code. I suggest you add some debug output to determine what response code you're getting and why.
https://github.com/zencart/zencart/blob/v155/zc_install/includes/classes/class.systemChecker.php#L331