6

This is not a duplicate question.

First of all, I have 3 "identical" Drupal 6.20 CMS desktop type websites using MySQL database 5.7.23 and PHP 5.6.40.

All 3 of these sites have been around for many years, and have never experienced this problem before.

Recently 2 of the 3 websites, (Site 1) http://sam308.com/ and (Site 2) http://closefocusresearch.com/ built in searches have been experiencing this exact same problem.

The problem is:

For example, on http://closefocusresearch.com/, When I use the built in search form on the website, and use a two-word term such a "body armor" without the quotes, or use any multiple word search term that includes spaces, the search results display the message ERROR 403 - FORBIDDEN. However, the search result url below has not changed.

The search result url for this page is:

http://closefocusresearch.com/search/node/body%20armor

Before this problem started happening, the above search results url would display the proper search results.

Now, the %20 in the url is causing the ERROR 403 - FORBIDDEN result as shown in the image below.

Since the space between the two words, body armor, has been replaced with a %20, I'm now experiencing resulting in the 403 error. This only happens if the search terms contains spaces, and otherwise works fine.

As a side note, if the manually replace the %20 with %2520, replacing the % with %25 in the url, as shown below, then I get the proper search results.

http://closefocusresearch.com/search/node/body%2520armor

If you want to test it for yourself, then use the site search box on the home pages.

I spent the last 3 days trying to find the cause this behavior on both the internet and at drupal.org, but could not find a solution. All the file permissions on all 3 websites are the same.

I also tried getting support from my hosting company, but they could not offer any help.

I also tried modifying the .htaccess file to correct this behavior, but had no luck. I'm not an expert in writing RewriteRule rules.

Could it be a recent Apache update bug causing this problem? Note: I cannot access the Apache system on a shared hosting plan.

Any ideas on how to fix this problem?

Thank you for your time.

ERROR 403 - FORBIDDEN result

Sammy
  • 877
  • 1
  • 10
  • 23
  • So what rewriting are you actually doing, regarding those URLs? Funny enough, it appears to work just fine, when a `+` instead of `%20` is used - although that is exactly the opposite of how it should be, https://stackoverflow.com/a/29948396/1427878 – CBroe Mar 17 '23 at 07:10
  • I'm not doing any .htaccess rewriting at the moment. I tried some rewrite examples I found here, but couldn't get it to work. I also tried editing both the Drupal search and node modules, but that didn't work either. I know about the + sign. If I manually replace the %20 in in the URL with the +, the search works, and returns a list of results. However, the search results page also returns the keywords back to the search form with the space between the keywords again. If you hit the search button on the results page, then it 403 fails again by putting back the %20 for the space in the URL. – Sammy Mar 17 '23 at 13:58
  • I meant, what creates the URL in that format, based on the form submission? Your form submission is a POST request to the `/search` endpoint, and that gets answered with a 302 and `Location: http://closefocusresearch.com/search/node/body%20armor` – CBroe Mar 17 '23 at 14:08
  • _"If you hit the search button on the results page, then it 403 fails again by putting back the %20 for the space in the URL."_ - only difference there is that the POST request goes to `/search/node`, but the result is the same - the server responds with a redirect _to_ the `%20` format. – CBroe Mar 17 '23 at 14:11
  • The URL is created within the Drupal search module. – Sammy Mar 17 '23 at 17:03
  • The URL is created within the Drupal search module. Below is the code in the module: `$form_id = $form['form_id']['#value'];` `$form_state['redirect'] = 'search/node/'. trim($form_state['values'][$form_id]);` I also tried adding a str_replace() for the trim($form_state['values'][$form_id]) part of the code, like: `$form_state['redirect'] = 'search/node/'. str_ireplace('%20', '%2520', trim($form_state['values'][$form_id]));` but it didn't work. – Sammy Mar 17 '23 at 17:13
  • The interesting thing, it that it used to work fine for years with the %20 in the URL. Now the %20 is causes the ERROR 403 - FORBIDDEN. – Sammy Mar 17 '23 at 17:24
  • Why don't you apply `urlencode` to the value, then the space would get encoded as a plus sign, and it should work? – CBroe Mar 20 '23 at 06:52
  • Nico: the AH10411 solution is close, but does not seem to help me much. Mark,s answer below worked. RewriteRule ^(.*)$ index.php?q=$1 [B,L,QSA] – Sammy Mar 21 '23 at 15:06

1 Answers1

8

I followed the instructions here, and looks like that solved the issue: AH10411 error: Managing spaces and %20 in apache mod_rewrite

Change your .htaccess from:

RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

to: RewriteRule ^(.*)$ index.php?q=$1 [B,L,QSA]

Mark
  • 106
  • 2