403 Forbidden error when updating product

[pinixdesign]

I just started getting an error under one of my cart's categories when I try to update the desciptions of a product under that category. It doesn't give the error under any other categories that I have found yet.

I receive the error:
Forbidden
You don't have permission to access /admin/product.php on this server.

The site is http://www.2griffins.com and it only does it for any products under Products - Desk Accessories > Pens and Pencils > Mont Blanc Pens and Pencils.

I was getting the same error under the Define Page Editor section after installing the SSL certificate on the site. I changed the following back to false for the admin and catalog and that fixed the problem there.

define('HTTP_SERVER', 'http://www.2griffins.com');
  define('HTTPS_SERVER', 'https://www.2griffins.com');
  define('HTTP_CATALOG_SERVER', 'http://www.2griffins.com');
  define('HTTPS_CATALOG_SERVER', 'https://www.2griffins.com');

  // Use secure webserver for catalog module and/or admin areas?
  define('ENABLE_SSL_CATALOG', 'false');
  define('ENABLE_SSL_ADMIN', 'false');

Any ideas?

- Karen

[DrByte]

what is the exact description that you are trying to change .... both "from" and "to" ?

I suspect your server may have a mod_security setting active which is trying to protect against the use of any "reserved words". Knowing what you're trying to enter may help...

[pinixdesign]

It does it for all products under the category Mont Blanc Pens and Pencils. I don't know exactly what the client was trying to change but I have tried anything for testing.

For example I will try to change the description on http://www.2griffins.com/index.php?m...products_id=47
from "Burl Wood Mont Blanc Pen" to "Burl Wood Pen"

What type of words are blocked? The only words that are in this category that are not in the others is "Mont Blanc"

[DrByte]

You have a .htaccess file in /admin, right?


So ... try an experiment.

1. make a backup copy of your /admin/.htaccess file. Store it in a safe place.
2. edit the /admin/.htaccess file, and add this to the very bottom:

  SecFilterEngine Off

3. Save the file and upload it to the server ... again, this is ONLY the /admin/.htaccess file
(only in the ADMIN folder ... not in any other place)

Now do your edits work?

If so, then it's a configuration issue related to mod_security that's causing your problems.

[pinixdesign]

THANK YOU!!! That did the trick!

I wish I had asked earlier!

[ladygodiva]

Just wanted to chime in and say you saved the day. As of today i was getting the same problem but that code fixed it. Thanks!

[TUSChris]

How do I get to the ".htaccess file?
I am getting this message when I try to add a product.

The webpage cannot be found
HTTP 404
Most likely causes:
There might be a typing error in the address.
If you clicked on a link, it may be out of date.

What you can try:
Retype the address.

Go back to the previous page.

Go to and look for the information you want.

More information

This error (HTTP 404 Not Found) means that Internet Explorer was able to connect to the website, but the page you wanted was not found. It's possible that the webpage is temporarily unavailable. Alternatively, the website might have changed or removed the webpage.

For more information about HTTP errors, see Help.

[nguyenhungpv]

I tried change it. Now i happy because I have overcome 403 Forbidden error when updating product

[dalesvp]

I suspect your server may have a mod_security setting active which is trying to protect against the use of any "reserved words".

Yesterday I began getting the forbidden access message while entering a new product. I suspected a word filter someplace as I've seen this before on a wiki. In posting the same new product as little information as possible was used to get the record started and saved. Then, updating the record, adding in the rest of the information one sentence at a time until the message reappeared - which it did on this sentence:

There are hundreds of selected quotes from the Cayce materials too.

All the sentences before and after the above words were accepted without error. I do not understand why any of these words would trigger or trip a filter. Anyone got any ideas?

[DrByte]

The word "SELECT" is commonly used in attempted SQL Injections. Maybe the mod_security rules are flagging that?