Downloads getting 403 forbidden after upgrading to 1.5.4

Here's my situation. I cannot for the life of me figure it out. So on my site running 1.5.1 customer can download .htaccess in the download and pub directory are identical to the ones in the /development directory. Also, the .htaccess in the web root public_html work fine as well. But when attempting to access the customer download it gives the 403 forbidden with additional 404 error. Here is the result of the error_log:

H01797: client denied by server configuration: /home/user/public_html/pub/.hlfmbyhgekgyurrtui-1421632673, referer: https://www.website.com/development/index.php?main_page=account_history_info&order_id=4421&zenid=7451f2cbec8191e732de7295a9c6cb8f

Any ideas would be greatly appreciated.

What's the filename extension you're trying to download?

Thanks for the response! The files are either .dmg or .exe and i've included them in the .htaccess in both pub and download directories. I've had this issue before a long time ago but it came down to this .htaccess issue. Everything seems fine here is the .htaccess on the /download directory:

#
# @copyright Copyright 2003-2013 Zen Cart Development Team
# @license [URL]http://www.zen-cart.com/license/2_0.txt[/URL] GNU Public License V2.0
# @version GIT: $Id: Author: DrByte  Fri May 17 14:29:18 2013 -0400 Modified in v1.5.2 $
#

AuthType Basic
AuthName "No access"
AuthUserFile .htnopasswd
AuthGroupFile /dev/null
#Require valid-user


###############################
#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

# but now allow just *certain* necessary files:
<FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|webm|m4v|m4a|dmg|exe)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a|dmg|exe)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

And here is the .htaccess inside the pub directory:

#
# @copyright Copyright 2003-2013 Zen Cart Development Team
# @license [URL]http://www.zen-cart.com/license/2_0.txt[/URL] GNU Public License V2.0
# @version GIT: $Id: Author: DrByte  Fri May 17 14:29:18 2013 -0400 Modified in v1.5.2 $
#

## the following line is needed to allow Download-By-Redirect to work
  Options +FollowSymLinks

#
# This is used with Apache WebServers
#
# The following blocks direct HTTP requests to all filetypes in this directory recursively, except certain approved exceptions
# It also prevents the ability of any scripts to run. No type of script, be it PHP, PERL or whatever, can normally be executed if ExecCGI is disabled.
# Will also prevent people from seeing what is in the dir. and any sub-directories
#
# For this to work, you must include either 'All' or at least: 'Limit' and 'Indexes' parameters to the AllowOverride configuration in your apache/conf/httpd.conf file.
# Additionally, if you want the added protection offered by the OPTIONS directive below, you'll need to add 'Options' to the AllowOverride list, if 'All' is not specified.
# Example:
#<Directory "/usr/local/apache/htdocs">
#  AllowOverride Limit Options Indexes
#</Directory>
###############################

# deny *everything*
<FilesMatch ".*">
  Order Allow,Deny
  Deny from all
</FilesMatch>

# but now allow just *certain* necessary files:
<FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|webm|m4v|m4a|dmg|exe)$">
  Order Allow,Deny
  Allow from all
</FilesMatch>

<IfModule mod_headers.c>
  <FilesMatch "(?i).*\.(zip|gzip|pdf|mp3|swf|wma|wmv|wav|epub|ogg|m4v|m4a|dmg|exe)$">
    # tell all downloads to automatically be treated as "save as" instead of launching in an application directly
    # ALERT: ForceType requires Apache2 or later. If using older version of Apache, it will need mod_mime installed. Or just comment out the ForceType line below
    # (to disable, just comment the next 2 lines by adding a '#' at the beginning of each):
    ForceType application/octet-stream
    Header set Content-Disposition attachment
  </FilesMatch>
</IfModule>

IndexIgnore */*


## NOTE: If you want even greater security to prevent hackers from running scripts in this folder, uncomment the following line (if your hosting company will allow you to use OPTIONS):
# OPTIONS -Indexes -ExecCGI

Using Download by Redirect or Download by streaming?

I had for some of my clients the same problem. They were running php as fCgi. For them I had to disable "Options +FollowSymLinks", by changeing this line

Options +FollowSymLinks

to

#Options +FollowSymLinks

But maybe the DR can shed some light on this.

mc12345678:

Using Download by Redirect or Download by streaming?
Clearly it's by redirect, as it's downloading from the pub folder, per the error message:
H01797: client denied by server configuration: /home/user/public_html/pub/.hlfmbyhgekgyurrtui-1421632673...

Design75:

I had for some of my clients the same problem. They were running php as fCgi. For them I had to disable "Options +FollowSymLinks", by changeing this line

Options +FollowSymLinks

> to
> ```
#Options +FollowSymLinks

You can try that.

In fact, the error message is caused by the webserver, not by Zen Cart.
Something is instructing the webserver to disallow access to that file, either because of the file's name/type or by other reasons configured elsewhere in your Apache, such as the visitor's IP address, etc.

As far as Zen Cart goes, the only changes to download handling are related to properly closing off sessions, so I'm confident to say that there were no changes between v1.5.1 and v1.5.4 that would suddenly cause this error because of any core PHP code changes.

There were small updates made to the .htaccess files:

• to add more extensions to the list
• to allow those extensions to be treated case-insentively.

So, maybe your server is incapable of recognizing the regex pattern for making it be case-insensitive. In that case, removing the (?i) from the beginning of the regex patterns in the 2 .htaccess files will suffice? If so, then it's also time to upgrade your Apache to a more modern version.

What about the fact that when the link is generated for download by redirect that the folder permissions of the temporary folder are set to 777 as compared to possibly needing to be 755 as required by the host? This is a file that gets replaced on upgrade if not compared: includes/modules/pages/download/header_php.php

mc12345678:

What about the fact that when the link is generated for download by redirect that the folder permissions of the temporary folder are set to 777 as compared to possibly needing to be 755 as required by the host?
That's a valid issue for downloads generally, but would not cause the quoted error message. Instead it would trigger a 500 Internal Server Error

DrByte:

That's a valid issue for downloads generally, but would not cause the quoted error message. Instead it would trigger a 500 Internal Server Error

And not possible to redirect a 500 to a 403 considering the "severity" of the error? (Asked, because someone recently was chasing an error that had been rewritten/redirected to give a different error code than the original error.)

mc12345678:

And not possible to redirect a 500 to a 403 considering the "severity" of the error? (Asked, because someone recently was chasing an error that had been rewritten/redirected to give a different error code than the original error.)

Sigh. That's highly unlikely. That would mean someone would have to have redirected 500 to something forbidden, which then in turn redirected to 403.

Your suggestions here are all possibilities, but in the 2% likelihood range.

DrByte:

Sigh. That's highly unlikely. That would mean someone would have to have redirected 500 to something forbidden, which then in turn redirected to 403.

Your suggestions here are all possibilities, but in the 2% likelihood range.

No disagreement in the low probablity in the suggestion being the cause. So is the occurrence of this issue, but the help thus-far provided (by you and the others) appears to cover all of the routine solutions and methods of approach to solve the issue or related.