By idcm on

first, let me say I think my clean urls issues has to do with the upgrade process as my fresh D6 sites don't have this issue. I have an issue posted views, in case this sheds more light http://drupal.org/node/427542.

Now the problem is a 403 error popup that says:

The page at http://mysite.com says: An HTTP error 403 occurred. /book/js/form

When clean urls are turned on, and I try to edit or create a node and assign it to a new book parent using book outline, I get the popup error. Also, when I try to make a node a book parent using the outline, same issue.

When I click ok on the error popup, the outline shows the book page or 'create book' option I selected. I click save and sometimes I get a screen that says:

Forbidden

You don't have permission to access /node/73/edit on this server.
Apache/2.0.51 (Fedora) Server at cindymccourt.com Port 80

BUT, sometimes I don't get this screen, it goes ahead and saves. I haven't been able to figure out the conditions for save vs no save yet. If I do, I will add it a comment.

I am posting this to see if anyone has had the issue before - after upgrading from D4.6.8 to D6.10. If so, ideas on what the problem is?

⋅ Categories: Drupal 6.x

Comments

idcm’s picture

idcm commented

here is an update on this issue. it appears it might be a server security issue.

"POST /book/js/form HTTP/1.1" 403 301 "http://website.com/node/add/page" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10" FYT8u38AAAEAACdx6ZAAAAAE "-"
Handler: redirect-handler
.
.
.
mod_security-action: 403
mod_security-message: Access denied with code 403. Pattern match "!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at HEADER("Content-Type") [id "9001"] [severity "EMERGENCY"]

My host did the following to remedy the situation

We added the rule in the modsecurity configuration file
In our case here: /etc/httpd/conf.d/modsecurity-carp.conf
-
The rule is this:

<Location /book/>
SecFilterRemove 9001
</Location>

hope this helps anyone else that has this issue.
Thanks to Neil Drumm for helping me with this.