403 forbidden when using toolkit's callurl on new Plesk 11.5 server configuration

[skepticwebguy]

I recently upgraded from Plesk 10.4.4 to Plesk 11.5. When my server was running Plesk 10.4.4, I used toolkit's "callurl" function on subdomain.domain.com to load an html file from domain.com. Something has changed on the new server configuration that no longer allows me to use toolkit's callurl function to fetch files from domain.com from subdomain.domain.com. It causes 403 Forbidden errors (i.e. "You don't have permission to access filename on this server") and "client denied by server configuration" errors in my server error log file related to the file on domain.com that callurl won't load.

I use alias settings in my vhost.conf file on subdomain.domain.com which point subdomain.domain.com/filename to domain.com/filename. I know these aliases are working because the file I am trying to call via callurl can easily be accessed directly usign the subdomain.domain.com alias. For instance, if in the callurl code I try to fetch http://subdomain.domain.com/file.html, I get the 403 Forbidden error when viewing my store page that contains the callurl function. However, if I simply load http://subdomain.domain.com/file.html into a browser I can see the file just fine. That file actually only exists at http://domain.com/file.html. So, I know vhost.conf server path alias is working correctly.

Any ideas what server configuration setting would allow direct-browsing of a file but deny access to that same file when called in via callurl?

I understand that toolkit's callurl function simply runs the built-in Miva library API function called MvCALL. What server settings would MvCALL require in order to fetch a file from a different server than the toolkit function is being run on?

[ILoveHostasaurus]

Re: 403 forbidden when using toolkit's callurl on new Plesk 11.5 server configuration

MvCall can be disabled by your server admin, so that would be one thing to check. The diagtool.mvc file that comes with the downloadable Empresa distribution will tell you if mvcall has been disabled or not. Assuming it has not, then the second issue could be that during the Plesk upgrade the site in question is no longer the default for the IP and the request is not coming in with the proper host headers for some reason, causing the request to be served not from the intended site but somewhere else that the file doesn't exist. The server's /var/log/httpd/error_log or /var/log/httpd/access_log would reflect the request if it was hitting a non-existent site. Third option is you have code in vhost, htaccess, server config, mod_security, anti-bot module, etc. that is viewing the request from Empresa as undesirable and is blocking it, while a request from a legit browser offering a normal-looking user agent is allowed through. The site error_log or server error_log should confirm this.

[skepticwebguy]

Re: 403 forbidden when using toolkit's callurl on new Plesk 11.5 server configuration

Hi David,

Thanks for the thorough response. I didn't see anything about mvcall in any of the diag6 results; the word didn't appear anywhere. So I assume that's fine. I confirmed that the domain.com in question is currently the default domain with a dedicated IP, same as before the upgrade. The server's error log points directly to the default domain when it reports "client denied by server configuration—pointing right to the file on domain.com that I am calling from within the callurl using the subdomain.domain.com alias. That's exactly how I knew the calls to those files wasn't working.

I've checked domain.com's htaccess file and found nothing that appears to be blocking anything — just some SetEnvIfNoCase User-Agent keep out settings for things like casper|cmsworldmap|diavol|dotbot. I checked my server's main httpd.conf file and nothing jumps out there. I could compare it line by line to the old server's default conf and see what's different.

Not sure where to look for server config (if not httpd.conf) and mod_security, nor anti-bot modules. Where do I look for those?

I'm not sure where the server error log is. I only know where to find the domain error log.

I'm starting to think this issue isn't worth solving. The only reason I want to solve it is so that I can continue calling on a few files that create global elements across the subdomain and main domain (i.e. main navigation, global footer). Worst case scenario is that I either manually enter the code I need in the store templates (which is what I did today to get it up and running), or I host the global element files on the subdomain and then link to them from the main domain (which won't be a problem, I suspect).

[skepticwebguy]

Re: 403 forbidden when using toolkit's callurl on new Plesk 11.5 server configuration

I revisited my htaccess file and did some systematic deletions of possible culprits and have now got this problem partially licked.

These lines in my htaccess file are part of the problem. They were there yesterday, before the Plesk upgrade, and it worked fine. But not today, after the upgrade.



<ifModule mod_setenvif.c>


SetEnvIfNoCase User-Agent ^$ keep_out

<limit GET POST PUT>
Order Allow,Deny
Allow from all
Deny from env=keep_out
</limit>
</ifModule>


Commenting out SetEnvIfNoCase User-Agent ^$ keep_out makes the callurl function load the file.


The broken part now is that when I use callurl to include a php file, the php isn't parsing. So, <?php ?> tags are showing in the source code for the browser-rendered page.

Plain HTML files work just fine when called via callurl. I've tried setting the callurl to GET and POST and neither makes a difference.

Thoughts?

[skepticwebguy]

Re: 403 forbidden when using toolkit's callurl on new Plesk 11.5 server configuration

Got it. Simply adding this line to my htaccess file worked:

AddHandler php-script .php

That wasn't required when the server had Plesk 10.4.4 on it.