Page 1 of 2 12 LastLast
Results 1 to 10 of 12
  1. #1
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Problem with htaccess inside of downloads folder

    Hi,

    Our host recently "upgraded" our server. This involved some sort of "in-place migration", meaning the IPs attached to our VPS did not change. However, certain problems have cropped up.

    Many of our product pages link to pdf's contained in the store's download folder. But if a link is clicked on, instead of seeing a pdf an error occurs:
    Internal Server Error 500

    The problem has been tracked to the htaccess in the downloads folder. When it is removed, the links work fine. However, that leaves the folder vulnerable.

    Here is the code from the htaccess:
    Code:
    #
    # @copyright Copyright 2003-2011 Zen Cart Development Team
    # @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
    # @version $Id: .htaccess 18695 2011-05-04 05:24:19Z drbyte $
    #
    
    AuthType Basic
    AuthName "No access"
    AuthUserFile .htnopasswd
    AuthGroupFile /dev/null
    #Require valid-user
    
    
    ###############################
    #
    # This is used with Apache WebServers
    #
    # The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
    # It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
    # Will also prevent people from seeing what is in the dir. and any sub-directories
    #
    # For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
    # Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified. 
    # Example:
    #<Directory "/usr/local/apache/htdocs">
    #  AllowOverride Limit Options Indexes
    #</Directory>
    ###############################
    
    # deny *everything*
    <FilesMatch ".*">
      Order Allow,Deny
      Deny from all
    </FilesMatch>
    
    # but now allow just *certain* necessary files:
    <FilesMatch ".*\.(zip|ZIP|gzip|pdf|PDF|mp3|MP3|swf|SWF|wma|WMA|wmv|WMV|wav|epub)$">
      Order Allow,Deny
      Allow from all
    </FilesMatch>
    
    <IfModule mod_headers.c>
      <FilesMatch ".*\.(zip|ZIP|pdf|PDF|mp3|MP3|swf|SWF|wma|WMA|wmv|WMV|wav|epub)$">
        # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
        # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
        # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
        # ForceType application/octet-stream
        # Header set Content-Disposition attachment
      </FilesMatch>
    </IfModule>
    
    IndexIgnore */*
    
    
    ## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
    # OPTIONS -Indexes -ExecCGI
    Is there something wrong with that?

    Or is there some service on the VPS (apache) that needs to be enabled?

    Huge thanks in advance for your thoughts!

    ~Mike

  2. #2
    Join Date
    Jul 2012
    Posts
    11,189
    Plugin Contributions
    13

    Default Re: Problem with htaccess inside of downloads folder

    Perhaps could also identify the server information made available through the admin->Version link? (assuming it offers information about the host computer). Seem to recall that there was some differences needed in the htaccess based on the version of the host computer's software. It had to do with resequencing the order and deny lines or something similar.
    ZC Installation/Maintenance Support <- Site
    Contribution for contributions welcome...
    Upgraded to Zen Cart V1.5.3 from V1.5.1 from V1.5.0 from V1.3.9h

  3. #3
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Re: Problem with htaccess inside of downloads folder

    Here are the headlines:
    Server OS: Linux 2.6.32-042stab120.19
    Database: MySQL 5.5.54-cll
    Server Date: 04/20/2017 16:27:55
    Database Date: 04/20/2017 16:27:55
    Server Up Time: 16:27:55 up 8 days, 23:38, 1 user, load average: 0.00, 0.02, 0.00
    HTTP Server: Apache
    PHP Version: 5.3.29 (Zend: 2.3.0)
    PHP Memory Limit: 128M
    PHP Safe Mode: Off
    PHP File Uploads: On
    Max Size: 64M POST Max Size: 8M
    Database Data Size: 64,558 kB
    Database Index Size: 3,077 kB
    Database Host: localhost
    Is there anything else, in particular, I can provide?

  4. #4
    Join Date
    Oct 2006
    Location
    Alberta, Canada
    Posts
    4,600
    Plugin Contributions
    1

    Default Re: Problem with htaccess inside of downloads folder

    But if a link is clicked on, instead of seeing a pdf an error occurs: Internal Server Error 500
    What does your Apache error log (located within your Hosting Control Panel) state about the error? It should tell you "why" it is a 500 error.
    The learning is in the doing.

    Potent Products

  5. #5
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Re: Problem with htaccess inside of downloads folder

    Not much, found this:
    [21/Apr/2017:10:58:21 -0400] "GET /download/cleaned/glowcore_cored_wire_tds.pdf HTTP/1.1" 404 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"

  6. #6
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Re: Problem with htaccess inside of downloads folder

    Received this from host support:
    "Is it possible that some service that was available on the previous version didn't get enabled on the new?"
    ^^^ If there were any major things that couldn't be moved over due to older PHP/MySQL/etc. versions no longer being supported, the upgrade ticket would have detailed those, so that you were aware of the changes. I don't see any mention of that in that upgrade ticket, however.

    Also, newer versions of WHM also deprecate/remove support for older things, and that may have happened here, if the WHM version was raised as well. I do see you're still on PHP 5.3 - it's also possible something in that (module-wise) wasn't brought over due to 64-bit switch and that being an older PHP version. You may want to consider trying to go to a newer PHP version (even just incrementally, for testing) to see if that helps. You can also look into EasyApache 4, which offers multiple PHP versions on same server, so you can set your testing site to, say, the latest version while your site stays on something much older.

    Without the original server to compare to though, it's hard to say exactly what is different.

  7. #7
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Re: Problem with htaccess inside of downloads folder

    In case anybody stumbles in here with the same problem, this solved it for me:
    https://www.zen-cart.com/showthread....ion-directives

  8. #8
    Join Date
    Jan 2004
    Posts
    64,707
    Blog Entries
    6
    Plugin Contributions
    214

    Default Re: Problem with htaccess inside of downloads folder

    Summary: your host upgraded to a newer Apache version, and left out the compatibility module to allow use of old-style auth directives.
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

  9. #9
    Join Date
    Apr 2010
    Posts
    745
    Plugin Contributions
    0

    Default Re: Problem with htaccess inside of downloads folder

    That would definitely seem to be the case. I will ask them to patch.

    Any chance you could help me to phrase my request? What, specifically, should I ask them?

  10. #10
    Join Date
    Jan 2004
    Posts
    64,707
    Blog Entries
    6
    Plugin Contributions
    214

    Default Re: Problem with htaccess inside of downloads folder

    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

 

 
Page 1 of 2 12 LastLast

Similar Threads

  1. htaccess issues with trying to redirect images to new folder
    By monkeyjr47906 in forum General Questions
    Replies: 0
    Last Post: 11 Oct 2016, 05:18 PM
  2. Changed site root folder and now have bad htaccess problem(s)
    By bodkin77 in forum General Questions
    Replies: 8
    Last Post: 30 Apr 2013, 10:57 AM
  3. Replies: 5
    Last Post: 31 May 2011, 09:54 PM
  4. Problem with .htaccess file
    By number5 in forum General Questions
    Replies: 4
    Last Post: 30 Sep 2009, 02:20 AM
  5. Problem with Yahoo Hosting/Zen-Cart - .htaccess
    By Tanahy in forum Installing on a Linux/Unix Server
    Replies: 1
    Last Post: 25 Aug 2008, 04:40 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
disjunctive-egg
Zen-Cart, Internet Selling Services, Klamath Falls, OR