Forbidden Error when adding (some) files to wiki page

[Gilbertdelyon]

Planethoter - HH1.17.2 - WIKI 2.3.8

I have big issue when adding files to a wiki page

If I add this link in the page

link 
[https://mydomain.fr/index.php?r=file%2Ffile%2Fdownload&guid=32dfc718-1bf7-4100-8201-29f7f6a15b0d&hash_sha1=93df20a8#.pdf](https://mydomain.fr/index.php?r=file%2Ffile%2Fdownload&guid=32dfc718-1bf7-4100-8201-29f7f6a15b0d&hash_sha1=93df20a8#.pdf) 

it works. I can save the page and use the link

If I add this link (notice: it is exactly the same url as before, only the text of the link is changed)

link
[test.pdf](https://mydomain.fr/index.php?r=file%2Ffile%2Fdownload&guid=32dfc718-1bf7-4100-8201-29f7f6a15b0d&hash_sha1=93df20a8#.pdf)

It doesn't work. When I save the page I get this error
Forbidden You don't have permission to access this resource.

Notice:

• This issue occurs only in wiki pages.
• It works without issue in posts in the same space
• I have cloned the site to another host. And there it works

Any idea?

[Gilbertdelyon]

Another example of the same issue

Step1

I load a file into the wiki page editor and get this link
[MEMO Création Theme.pdf](file-guid:cc95cb65-f615-46a7-937a-4dcb2a56a9e9)
Notice: MEMO Création Theme.pdf is the original name of the file

It works!

Step2
Now I edit the page and change the link as follows
[testPDF.pdf](file-guid:cc95cb65-f615-46a7-937a-4dcb2a56a9e9)
Notice: the file guid is the same as before

I get this error when I save the page
Forbidden You don't have permission to access this resource.

Step3
Now if I proceed exactly the same way in a post, in the same space, with the same file
I have this in the editor

[MEMO Création Theme.pdf](file-guid:cc95cb65-f615-46a7-937a-4dcb2a56a9e9)

[testPDF.pdf](file-guid:cc95cb65-f615-46a7-937a-4dcb2a56a9e9)

I can save the post and both links are working

[Gilbertdelyon]

And an other example test

Step 1
I add these 2 files in a post.

[micro-tuto_framacalc.pdf](file-guid:28125a83-0208-414a-a0fb-dfe054cb4cd4)
[TEST PDF 0.pdf](file-guid:4ac10307-a545-4828-bbf9-52ee583c8daa)

It works!

Step 2
same host, same site, same space

I add exactly the same files in a wiki page

[micro-tuto_framacalc.pdf](file-guid:28125a83-0208-414a-a0fb-dfe054cb4cd4)
[TEST PDF 0.pdf](file-guid:4ac10307-a545-4828-bbf9-52ee583c8daa)

It doesn't work. When I save the page I get this error
Forbidden You don't have permission to access this resource.

Step 3
I delete the second file (only the second file)
It works

Step 4
In the same wiki page I rename the text of the second file link

[micro-tuto_framacalc.pdf](file-guid:28125a83-0208-414a-a0fb-dfe054cb4cd4)
[micro-tuto_framacalc.pdf](file-guid:4ac10307-a545-4828-bbf9-52ee583c8daa)

Notice:
the files guid remains unchanged
The text link of the second (culprit) file is now the same as the first file.
IT WORKS!
I can save the page
First link drives to the first file
Second link drives to the second file

Step 5
I have a perfect clone of the site in another host server.
No issue in this host. It works.

Please find attached the 2 files
This one works
micro-tuto_framacalc.pdf
This one doesnt work
TEST PDF 0.pdf

[marc-farre]

Related post: https://community.humhub.com/content/perma?id=288522

[Gilbertdelyon]

This issuie is not specific to wiki pages.
Same behaviour in Markdown custom pages
Also, not possible to add images in both cases.
Upload of files and images works, but we get an error when saving the page
Forbidden You don't have permission to access this resource.

No issue in posts

[Gilbertdelyon]

@yurabakhtin
@marc-farre
@luke-
Here are some additional tests - Directly in data base

STEP1:
I open the site and I create a new post
Add 2 files (via the menu of Markdown editor)
Save
Open the data base and find this

It works!

STEP 2:
I create a new "hello" wiki page
Save
Open the data base and find this

It works!

STEP3:
Edit the page content directly in bata base
Add the first file link from the post content (step1) like this, and save

itworks

STEP4:
Edit again the page content directly in bata base
Add the second file link from the post content (step1) like this, and save

it doesnt work

STEP5:
Same as STEP4, but this time I modify the text of the second link. It's now the same as in the first link (file guid is not changed)
save and get this

This time it works!

Hope this will help you finding out the reason of this issue

May I remind you:

• the issue is only in wiki pages and markdown type custom page,
• the issue is only in Planethoster, not in o2switch, not in Ionos.
• I have made a clone of the site from PlanetHoster to o2switch (copy/paste of the site folder, export/import of DB). No issue in othe clone.
• The 2 files are attached in one of my previous comment
• I couldn't find any discriminant between file 1 and file 2. I suspect an encoding issue in the file name, but I dont have any knowledge in this matter and it works in the post.

Thank you in advance for you precious help
Let me know if you need me to make additional tests
For the moment I have no access to the php logs of the site

[Gilbertdelyon]

New tests.
I start again from STEP2 of previous comment and progressivly add some text in the content
And this is the result

So, I guess the issue isn't a matter of adding files to the page but It's a matter of encoding. But this matter is out of my skill!
Notice in all databases, (Planethoster , site clone in o2switch) the encoding of all tables is utf8mb4_unicode_ci . I guess it comes from db creation during HH site installation

BTW. I just see that in another site database some of the tables are utf8mb4_unicode_ci . and some are latin1_swedish_ci . I dont know if it could be a problem, but any way this site is working like a charm

[yurabakhtin]

• the issue is only in Planethoster, not in o2switch, not in Ionos.

@Gilbertdelyon I think the problem the Planethoster has some security filters.

• ModSecurity or a similar Web Application Firewall (WAF) is blocking the request when certain patterns appear in the content.
• In particular, the text string "TEST PDF 0.pdf" inside the request body (possibly in the markdown) may trigger such a filter.

If you have access to logs on PlanetHoster, try to check the server’s error logs:

• Apache: /var/log/apache2/error.log
• Nginx: /var/log/nginx/error.log
• CMS / PHP / ModSecurity (modsec_audit.log)
• PHP error logs

You might see something like:

ModSecurity: Access denied with code 403 (phase 2). Match of "test pdf 0" against REQUEST_BODY

Temporarily disable ModSecurity (if possible)
In your .htaccess file:

<IfModule mod_security.c>
  SecRuleEngine Off
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

Note: This doesn’t work on all hosts. Some require disabling ModSecurity via the control panel (e.g., cPanel -> ModSecurity -> disable for your domain).

Please try to contact PlanetHoster support and ask if they can check their ModSecurity (or similar WAF) logs, provide an example request that triggers the 403 error, they may be able to whitelist or disable the specific rule causing the problem.

[Gilbertdelyon]

@yurabakhtin
I am not the owner of the Planethoster account and for the moment I have acces only to the site folder, not to cPanel.
The owner is absent for some days.

But I doubt Modsecurity is the origin of the issue, because.

1. • As explained in previous posts, I have built a 'perfect" clone of the site from Planethoster to o2switch (copy/paste of site folder + export/import of data base). Modsecurity is activated in o2switch. There is no issue in the clone.
2. • In the same site and DB, the same link to the same file works in a post, and doesn't work neither in wiki pages, nor in markdown custom pages.

I suspect the 'post' and 'wiki_page_revision' tables to behave differently but I cannot find out how and why.

Edit: In the meantime I learned a few things about Modesecurity and I understand that rules can be different from one host to another. This could explain why it works in o2switch and not in Planethoster.

But it doesn't make clear why, in Planethoster, it works in 'post' table and not in 'wiki_page_revision' table

[Gilbertdelyon]

1/ Good news:
@yurabakhtin you were on the right way
We have desactivated the WAF in PlanetHoster and now it works !
Thank you for your precious help.

2/ One question still remains:
There is something different in the request that makes it fail in wiki pages and Markdown custom pages, and NOT in posts.
Markdown is a very popular syntax. I guess there are plenty of other sites that are using it with success in Planethoster and I am not sure PlanetHoster will agree modyfing the rules for our small site.

[yurabakhtin]

There is something different in the request that makes it fail in wiki pages and Markdown custom pages, and NOT in posts.

@Gilbertdelyon Do you have there the same errors even with the deactivated WAF?

[Gilbertdelyon]

@yurabakhtin

Do you have there the same errors even with the deactivated WAF?

No. After disabling the WAF we dont have any error.

The issue is only when WAF is enabled and only when saving wiki pages and markdown custom pages that include a markdown syntax link (but not 100% of the times, it depends on the string inside the brakets).
You can refer to this comment for more details
Notice: no error with escaped brackets. No error with this string \[abc\](abc)

[Gilbertdelyon]

@yurabakhtin
Since a few minutes I have now access to the NOC (NOC is a kind of custom cPanel in Planethoster server) and I can investigate more precisely.
There are 1491 rules in the WAF
The error is generated by one single rule.

When this rule is disabled it works

This is a partial crop of the error 403 report

Please let me know if you need some additional information