Hi

Sorry for the long post, but i will try to include as much info as possable.

I have recently noticed the following error logs in my cpanel.

client denied by server configuration: /home/mysite/public_html/includes/templates/mytemplate/css/none, referer: http://www.mysite.com/

I have read various threads on the forum which have helped to some degree.

If I rename includes/.htaccess to .htaccess_off
then the errors stop!

I have asked my hosting company if the httpd.conf file has 'Limit' and 'Indexes' parameters to the AllowOverride configuration, and this was their response

**"Those options are already included as standard:

Options +ExecCGI +FollowSymLinks +Includes +IncludesNOEXEC +Indexes -MultiViews +SymLinksIfOwnerMatch"**

I then asked why 'Limit' was not on the list, and my response was this.

"As advised we don't modify the httpd.conf file, any changes you would need to make within your .htaccess file. This is a scripting issue that's not part of our support to diagnose for you."

The website functions correctly, but I know these errors shouldn't be there.

So I am here asking for help, as to how I may modify the includes/.htaccess file without compromising my websites security.

What is in your .htaccess? will you post it here

Thank you :smile:

Contents of includes/.htaccess

@copyright Copyright 2003-2010 Zen Cart Development Team

@license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0

@version $Id: .htaccess 17394 2010-08-28 03:16:06Z drbyte $

This is used with Apache WebServers

The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions

It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.

Will also prevent people from seeing what is in the dir. and any sub-directories

For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.

Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.

Example:

#<Directory "/usr/local/apache/htdocs">

AllowOverride Limit Options Indexes

#</Directory>
###############################

deny everything

<FilesMatch ".*">
Order Allow,Deny
Deny from all
</FilesMatch>

but now allow just certain necessary files:

<FilesMatch ".*.(js|JS|css|CSS|jpg|JPG|gif|GIF|png|PNG|swf|SWF|xsl|XSL)$">
Order Allow,Deny
Allow from all
</FilesMatch>

IndexIgnore /

NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):

OPTIONS -Indexes -ExecCGI

Interceptor:

client denied by server configuration: /home/mysite/public_html/includes/templates/mytemplate/css/none, referer: http://www.mysite.com/
You need to be looking for why your site is suggesting a filename of "none".

Looking in .htaccess is completely the wrong direction. The .htaccess is CORRECTLY blocking files named "none", because there's no good reason for calling a CSS file by the name of "none". (For the purists, of course one "could" but that's another topic altogether and entirely outside the scope of the way Zen Cart works.)

You need to find out why your site is even attempting to ask for a "none" file name.

client denied by server configuration:

• this indicates that a directive within your .htaccess prevented someone from doing something

/home/mysite/public_html/includes/templates/mytemplate/css/none,

• this is something that I'm starting to see more 'n more of and on various Servers with various versions of Zen Cart, seems to be more related to how the Server is configured than Zen Cart itself but puzzling nonetheless

Just a hunch, without any proof yet, that it's caused by poor URL rewriters.

Or templates that have replaced the original ZC code which calls files with actual .css extensions on them.

Website Rob:

/home/mysite/public_html/includes/templates/mytemplate/css/none,

• this is something that I'm starting to see more 'n more of and on various Servers with various versions of Zen Cart, seems to be more related to how the Server is configured than Zen Cart itself but puzzling nonetheless

This is not a 'server configuration' issue. It's just 'bad' code somewhere.

Here's a nice video tutorial on how to find the cause.
http://youtu.be/Ev-cLvYnJ_k

Cheers
Rod

Nice catch, Rod.

Just bad (sloppy) CSS coding, using invalid syntax like:

background:url(none)

Thanks to all that replied, you been a great help. :D

Problem now solved.
For those that took the time to reply, and to those that may stumble across this thread in the future, heres the cause.

It turns out that there was 2 lines in my stylesheet.css which were causing the apache error logs.

The line in question was

background-image:url('none');

apparently apache sees anything between the brackets as a valid url

I did spot this before, but as I was editing the css file in FrontPage, when I edited the file to

background-image: none;

and clicked save, it would correct it back to the original line (albeit wrongly)

So I changed my default editing software to Notepad++ and made the change again, and hey presto, no more error logs.

So in a nut shell, dont use FrontPage for editing code:censored:

Yup. FrontPage is THE WORST application for editing code.

Indeed most applications by Microsoft are notoriously bad for coding/writing/designing for the web.

Hi Folks,
I think my issue is similar, but caused by looking at a category and paging through the products in the category.

From my home page, I select the category "Christmas Goodies". When I do this I see the first 24 products in that category. I can then use the [Next >>] link to go to the next 24 products. I can also choose the page number to jump to as well.

In my situation, given the category of "Christmas Goodies" I can select [Next>>] to go to page 2, then page 3, but at page 4 I get a blank screen. When I got the blank screen I also see the following errors in my error log:

[Wed Sep 30 10:48:29 2015] [error] [client 24.147.42.112] client denied by server configuration: /home/TheUser/public_html/includes/js, referer: http://www.jollygrub.com/abritish-christmas-goodies?sort=20a&page=4
[Wed Sep 30 10:48:26 2015] [error] [client 24.147.42.112] client denied by server configuration: /home/TheUser/public_html/includes/js, referer: http://www.jollygrub.com/abritish-christmas-goodies?sort=20a&page=3
[Wed Sep 30 10:48:26 2015] [error] [client 24.147.42.112] client denied by server configuration: /home/TheUser/public_html/includes/js, referer: http://www.jollygrub.com/abritish-christmas-goodies?sort=20a&page=3

Now, the path show of "/home/jollygru/public_html/includes/js" does not exist as a directory or a file.

I think that getting the blank page is the result of this error, but I am not sure where to locate the problem.

Can anyone point me in the right direction?

Thanks in advance!!!

You need to find out what products show on page 4 I think, because page 5 and 6 also work fine. My guess is you have a product that makes a call to that specific path.

You could also possbly search the files for a portion of that path using tools->developers tool kit. Would suggest eventually checking all file types until it is found. Ie, php and js at least.