403 error mod_rewrite

[cf10 guy]

.htaccess:

Options +FollowSymlinks

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteCond %{REQUEST_URI} !^.*\.(bmp|css|gif|htc|html?|ico|jpe?g|js|pdf|png|swf|txt|xml)$

RewriteRule ^(.*)$ /index.cfm/$1 [NS,L]

ErrorDocument 404 /index.cfm?action=public:error.notfound

httpd.conf:

<Directory C:\www>

  AllowOverride All

  Allow from all

</Directory>

When I try to access /admin or even /admin:main.default, it throws a 403 error (You don't have permission to access /admin/ on this server). If I try /admin/main/default, it works fine.

Any ideas?

[Chris Blackwell]

You haven't said what os, but if it's Windows then apache doesn't allow a colon (:) inv the first portion of the url. It's something to do with stopping absolute path exploits accessing c: etc.

Chris

--
--
FW/1 on RIAForge: http://fw1.riaforge.org/
 
FW/1 on github: http://github.com/seancorfield/fw1
 
FW/1 on Google Groups: http://groups.google.com/group/framework-one
 
---
You received this message because you are subscribed to the Google Groups "framework-one" group.
To unsubscribe from this group and stop receiving emails from it, send an email to framework-on...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[cf10 guy]

Thanks for the suggestion, but it throws the same error even when I don't use the colon (ie /admin). And yes, I'm running Windows.

[Erik Meier]

What does the apache error log say?

As mentioned. Apache gives fits on windows with : as the delimiter. I think a workaround was posted a while back. 

[cf10 guy]

Directory index forbidden by Options directive: C:/www/test/admin/

[cf10 guy]

Google is telling me to add Options +Indexes in the .htaccess file, which gets rid of the error but now it shows a directory list instead of Framework 1 parsing the URL.

[denstar]

On 5/15/13 6:17 PM, cf10 guy wrote:
> Google is telling me to add Options +Indexes in the .htaccess file, which
> gets rid of the error but now it shows a directory list instead of
> Framework 1 parsing the URL.

+Indexes just adds indexes (what you're seeing), which is not what
you're after.

Is index.cfm listed in the apache DirectoryIndex directive?

Also, enabling rewrite logging will shed a lot more light on what apache
is doing with those rules.

:Denny

--
Speak the truth, even if your voice shakes. - Unknown

[cf10 guy]

Yes, index.cfm is listed in the DirectoryIndex. As I've mentioned, this rewriting works for some things but not for others. I have a public subsystem that works perfectly fine, it's just the other subsystems such as admin that have problems.

/plans => routes to /public/plans and works as expected.

/admin => routes to /admin/main/default and does NOT work unless you specify something AFTER /admin (ie /admin/main).

[cf10 guy]

/plans => routes to public:plans.default and works as expected.

/admin => routes to admin:main.default and does NOT work unless you specify something AFTER /admin (ie /admin/main).

[cf10 guy]

RewriteCond %{REQUEST_FILENAME} !-d

Removing the above line in .htaccess solved my problem.

On Wednesday, May 15, 2013 3:19:00 PM UTC-4, cf10 guy wrote: