403 Forbidden on /connectors/resource/index.php

I've been unable to save any files resources that I had migrated to my database (from another Revolution install) - I was getting stuck on "please wait - saving" and with a little snooping I find that I am getting these javascript errors:



And if I load that php file, I get:



the content of that PHP file is:



Can anyone tell me why I'm getting a 403 error there? I am happy to post my htaccess file if that would help. I only get these errors when trying to update migrated resources (or after duplicating previously migrated resources). If I create a new resource, it works.

Using the 2.2.1-pl release, installed fresh yesterday, I am having the same problem while trying to save documents. It doesn't happen on each document and there doesn't seem to be any rhyme or reason – that I've been able to determine yet.

I received the following three Javascript errors when I was stuck in the saving loop:

1. TypeError: 'null' is not an object (evaluating '/^[^?#]*\//.exec(location.href)[0]')
2. POST http://www.mywebsite.com/connectors/resource/index.php 403 (Forbidden)
3. SyntaxError: Unexpected token '<'

The first seems to be specific to Safari in regards to the file it refers to. The second is directly referring to "/connectors/resource/index.php". The third refers to "/manager/assets/ext3/ext-all.js", presumably line 7.

I have noticed that at the times that it does save, I still receive a Javascript error, but only the first of those three.

I have nothing showing in the Error Log. It's completely blank. That is of no use. I am experiencing this in both Firefox 11.0 and Safari 5.1.5 on Mac OS X Lion 10.7.3. While digging on this issue, I found another person was seeing this only in Opera 11.61: http://my.opera.com/community/forums/topic.dml?id=1287402. It refers to several Modx links.

Update:

It seems that I've been able to narrow this down to happening only when I try to add an inline CSS style. That I do not understand at all. I have done this on another Revolution install (2.2.0-pl2) and do not have this issue. That install is however on another server. [ed. note: thomasgrant last edited this post 14 years, 5 months ago.]

I believe I discovered the problem and solution. Strangely enough, it wasn't until I got this Javascript error again on "/connectors/element/plugin.php" when trying to create and save a new plugin. After some thorough digging I discovered that an Apache module "mod_security" is the culprit.

It seems someone else was having a similar problem when downloading packages: https://forums.modx.com/thread/73874/download-package-fails-403-forbidden. Not much of value there. But then I discovered this older Modx Wiki document: http://wiki.modxcms.com/index.php/What_is_mod_security_and_how_does_it_affect_me. It pointed me in the right direction, but it applies to Apache Module "mod_security". My environment (Plesk VPS) is using "mod_security2".

I then discovered the link: http://blog.surgeons.org.uk/2008/02/disabling-modsecurity-2-for-individual.html, which discusses the same problem and gives details about working around "mod_security2". It is mentioned there how to achieve this on a Plesk VPS environment. You can also read more about this at http://atomicorp.com/wiki/index.php/Mod_security.

Two Things to Note:

1. "mod_security2" no longer allows changes via .htaccess. This must now be done through an Apache configuration file.
2. Commands have changed. For example: "SecFilterEngine Off" is now "SecRuleEngine Off".

I am currently using the following in a "vhost.conf" file:



With no knowledge on configuring this module, I am not yet sure how to leave the module enabled while only bypassing for manager functions – as done by the original "mod_security" command:

For everyone that is on shared hosting and cannot edit the server config file, we figured out a solution that uses an .htaccess file that you place inside /connectors/resource.

The file needs to have the following in it: