Install Permissions Error: 403 Forbidden

[sparrowce]

I am installing a DEMO of 154 to make sure all the customizations in 139 are captured. Created SQL database on host for the demo, unpacked 154 to a 'demo' store folder on host. Have renamed configure files/changed permissions per below instructions in docs/readme_intallation html file.

For a new install, the simplest way to do this is to rename these two files:
- /includes/dist-configure.php
to /includes/configure.php
- /admin/includes/dist-configure.php
to /admin/includes/configure.php

After renaming and changing folder permissions to 777, I put specific domain/demo folder info browser url per: http://www.mydomain.com/catalog install instructions.

Then I get the system setup required screen, and when I click here to continue, I get 403 forbidden permissions error. What am I missing? Have existing store on host already working, so the server/host side should be ok.

[stevesh]

I'd like to see the installation instructions updated.

Try this in post #7:

http://www.zen-cart.com/showthread.p...mmies-%28me%29

[RodG]

After renaming and changing folder permissions to 777,

Although *probably* unrelated to your specific problem zencart only requires a couple of *specific* folders to be world writable (aka 777 permissions.)

Changing *other* folder permissions to 777 will actually cause many servers to 'die' with a 'server 500 error', which is usually a lot more difficult to diagnose than a 403 error.

Then I get the system setup required screen, and when I click here to continue, I get 403 forbidden permissions error. What am I missing?

A valid file or folder permission would be my guess. :-)

Problem here is that *we* have no way of knowing which file or folder this is referring too.

A couple of likely candidates do spring to mind though, and that is the /cache/ folder (which is one of the few that require 777 permissions (he says cautiously), and/or the the two configure.php files, which need write permissions during the install, and need to be set back to read only for when the site is actually functioning.

These are just guesses though, and *probably* not very good ones, because the Zencart installation code checks and reports if these are incorrect before it will allow the installation to start.

Have existing store on host already working, so the server/host side should be ok.

Agreed, so on that basis, you actually have it a little easier than most, in that you are in a position where you can compare the folder/file permissions between the working and non working sites, and 'correct' the ones on the 'new' site that are different from the working site.

If there is an error message, log file, or some other information that you can find/provide that could point you/us to a specific folder/file then you won't need to check *everything*. Information is the key to a quick resolution. Anything else is an educated guess (at best) and a wild guess (at worst).

Cheers
RodG

[sparrowce]

Thank you for the replies and help. stevesh, that is a great idea about the 'custom' folder tree, that will be so helpful. RodG, I've re-checked permissions on cache and other folders, and they seem to match what the installation instructions call for.

Am getting this message: 'You don't have permission to access //www.mydomain.com/catalog/zc_install/index.php on this server.'. I could be wrong about the host/server side, for sure. Even though there is already a cart working there, could that permission from them be at a folder level where I need to get my new demo folder modified by them on the server? It has been a very long time since I first worked with the installation of Zen Cart and am re-learning. Appreciate the help.

[RodG]

RodG, I've re-checked permissions on cache and other folders, and they seem to match what the installation instructions call for.

Point#1. "seem to match" isn't the same as *does match*. At least not to me.
Point#2. You have apparently *ignored* what I suggested you do if I were in your situation (although that is probably no longer relevant since you have given a teeny bit more info that negates many of those folders that could have had invalid permissions - up to a point, at least.)

Am getting this message: 'You don't have permission to access //www.mydomain.com/catalog/zc_install/index.php on this server.'.

Well, this is a *little* more info than previously given, but of little help at the moment because I am assuming that this is an edited or paraphrased report rather than what the message *actually* says.

If my *assumption* is wrong, then I'm not surprised that you are getting a permissions denied error, because I'm 100% convinvced you don't own the "www.mydomain.com" domain name.

If I *assume* that you have replaced your real domain name with this 'dummy' domain name, it leads me to the question of those leading slashes //

Were they *also* part of *your* edit, or were they part of the *actual* error message? If they were a part of the *actual* error message, was there some other text that preceded that - "http" or "https" for example? This may be unimportant or insignificant detail to *you* perhaps, but not to us.

Not all servers will allow/support site access without a protocol specifier (as per your edited/paraphrased message) and if this is what the *actual* error message shows it would suggest that there is something amiss with your configure.php file(s) and that the 'http' and/or 'https' are missing from there too. How this occurred or could occur isn't really important at this stage, the fact is, due to your edit I/we really don't know if this is the case or not.

A permission denied could also be because the install script is using https, and your site isn't set up for it (or vice versa, the script is using http, and the site is expecting https).

Again, you have 'hidden' this clue from us with your edit, so you'll need to investigate these possibilities yourself.

I could be wrong about the host/server side, for sure.

Based on this teeny bit of additional information you have provided, I am no longer convinced that it *isn't* server related either. Until now, I was, but the hidden or missing information has made me realise that it may not be server related 'per se', but could still be related to server settings related to SSL (or lack of).

Even though there is already a cart working there, could that permission from them be at a folder level where I need to get my new demo folder modified by them on the server?

Yes, or the zc_install folder, or its subfolders.

It has been a very long time since I first worked with the installation of Zen Cart and am re-learning. Appreciate the help.

We'd love to help, really we would, but at the moment there are so many possibilities that all we can do is make guesses based on assumptions. I've covered several possibilities in this reply, some being far more probable than others. If we had more information or information that we could *depend* on, I/we could eliminate many of these possibilities on your behalf, but as it stands, you are still very much on your own to eliminate them for yourself.

Cheers
RodG

[sparrowce]

Understand completely, thank you. I apologize if my reply did not give enough info or speak with clarity. In clarifying, the demo permissions matched instructions and the others did not have 777, and also compared to current store. Where will I find a log file? The logs folder didn't have any. I will check into your https comment, as there is SSL set up on site. Will also check with host before continuing to make sure all is well on server side. You are right about the error message. I posted it wrong. Had copy/pasted from the wrong browser tab, so sorry. Here is the exact message:

"You don't have permission to access /mydemo/zc_install/index.php on this server."

[RodG]

Understand completely, thank you. I apologize if my reply did not give enough info or speak with clarity. In clarifying, the demo permissions matched instructions and the others did not have 777, and also compared to current store. Where will I find a log file? The logs folder didn't have any. I will check into your https comment, as there is SSL set up on site. Will also check with host before continuing to make sure all is well on server side. You are right about the error message. I posted it wrong. Had copy/pasted from the wrong browser tab, so sorry. Here is the exact message:

"You don't have permission to access /mydemo/zc_install/index.php on this server."

Still not much in the way of useful information.

Care to PM me the full URL for this installation? I make no assurances that this will provide me with additional clues, but it may go a long way to tell you what and where the problem *isn't*, and that could greatly narrow things down to what it *is*.

If you are uncomfortable providing me this info, I'm sure there must be someone else around here that you can trust (and will be willing to help). Failing this, you're pretty much on your own.

Cheers
RodG

[mc12345678]

Isn't that path supposed to reflect the entire path from the root of the host to the account's folder on to the store/zc_install?

Able to post the includes/configure.php file from the existing functional site and this new one? Obscure database password.

[RodG]

"You don't have permission to access /mydemo/zc_install/index.php on this server."

There is yet another possibility that I/we haven't yet covered, and that is the server may be using 'mod_security' (very common these days) and some site admins have made the rules/filters associated with this a little *too* restrictive.

If this IS the case (and this is something only your host will be able to determine for sure), you can try loading the file
zc_install/.htaccess into a text editor, and add the following lines to the end of the file

SecFilterEngine Off
SecFilterScanPOST Off

Save the file and see what happens.

I expect 1 of 3 things.

1) The install will go ahead with no further problems.
2) There will be no *apparent* change
3) The server will 'crash' with a "500 Internal Server Error".

If its #1, problem solved.

If it's #2 The problem it is almost certainly NOT related to mod_security - The search continues.

If it's #3 It could still be related to mod_security but you will need to ask you host to look into matters and either disable mod_security for your site, or better yet, they'll investigate which of the many rules are causing the problem for you and remove just that particular rule.

Ideally you should try to eliminate all other previously discussed possibilities first though, because many of them are more probable than the mod_security possibility (and trying to convince a webhost that their security rules are causing an issue can be a very challenging task). As far as THEY are concerned you want them to relax the rules for nefarious purposes, so you may need to *prove* to them you've eliminated all else before they'll even consider it).

In my experience, trying to negate the SEC rules via the .htaccess file results in the 500 server error most of the time, but that doesn't mean you won't get lucky - it depends on the host.

Cheers
RodG

[sparrowce]

Sorry to be so long replying, have limited time to work on this. I feel so stupid, especially with all the help and ideas that have been offered. Finger points back to me - the install instructions say right up front PHP needs to be 5.3. I totally ran right through that page, and it ran over me! When I checked PHP version on server, it was 5.2, so that may be related to this issue. Host gave me a link to set PHP to 5.3. Did that and when it's set to PHP 5.3, in the live version 1.39h, I get 'There was a security error when trying to login' error logging into Admin'. In upgrading the PHP, am needing to make sure no live shop issues before circling back to installing demo of 154 to get that up and running/customizations merged in. If I set PHP on host back to 5.2, I can login to live shop with no issues. At PHP 5.3, I can login as a customer and so far no issues from customer perspective. I have been toggling PHP versions back and forth and currently it's at 5.2 since I can't login to Admin at 5.3.

Am back-tracking to upgrade the PHP and work through the login issue. Then can see where I'm at with 154 install after the PHP upgrade. Have been reading many threads here where Admin login didn't work after PHP upgrades, and the solutions were varied. I did try the clear cache and password reset methods mentioned in several threads, with no success. They also mentioned php.ini files, though I do not know what to do there. In the link the host gives us to set PHP version, there is a php.ini/edit section. Please let me know what other info I need to provide. I also read where 1.39 should be compatible with PHP 5.3, so I must have something wrong somewhere.