URL not recognized when submitting article (OJS3.3.) - throwing 403

[CL1506]

Describe the issue or problem
When users/authors try to submit article, submission/upload fails with above error message and 403 forbidden as per Google Chrome Dev Console. I have checked permissions and disk space already, have deactivated htaccess, have set Restful_urls = Off and my base_url = is https://ojs.domain.de".

I would expect that if I dont do mod_rewrite and restful_urls = off the installation should work just fine out of the box. Am I wrong? Any hint or support highly appreciated because I went through this whole support forum and rest of google almost… Thanks!

[asmecher]

Hi @CL1506,

Your server probably has a security tool such as mod_security, and it is incorrectly flagging the upload interaction as an attempt to hack the server. If so, its log should capture details.

Regards,
Alec Smecher
Public Knowledge Project Team

[CL1506]

Hi Alec,

thanks for getting back! I have ruled out mod_security already earlier on based on postings I found here in the forum…based on a ticket i had with the hoster.

let me maybe ask two precise questions:

how would a default/standard url look like that calls the submission api if i only have one journal maintained?

I have the feeling that it has to do either with my new php version or with something in config.inc.php. given the fact i do not have an htaccess. if i had that, how would my rewrite rules look like?

By the way hoster is IONOS and setup worked fine until recently, so I really dont know where to look for…

One other thought: base_url: is it ok to have it with the subdomain or does it need to include www…

how to efficiently debug this further?

thank you!

[asmecher]

Hi @CL1506,

It’s very unusual for OJS to respond with a 403 code – there are only a few conditions and they aren’t likely in your configuration. I would suggest trying to upload a very small file (perhaps a text file of only a few bytes). If this succeeds, but a more normal submission file causes a 403 response, then the problem is something else in your server stack that’s preventing the request from getting through to OJS.

Regards,
Alec Smecher
Public Knowledge Project Team

[CL1506]

Hi Alec,

thanks for your continuing support…i tried already with multiple file sizes and formats, no luck…just cant find the needle in the stack it seems.

Does a URL like this one ( throwing the 403 ) look like it should work normally ( as desgined) ?

https://ojs.domain.de/index.php/[journalname]/api/v1/submissions/1198/files?journal=[journalname]&endpoint=/[journalname]/api/v1/submissions/1198/files

I got this one from Chrome Dev Tools Console but it looks to me a bit strange, or am I wrong?

[asmecher]

Hi @CL1506,

Sorry for the delay in responding!

Ah, I think I see the issue. You’ve got disable_path_info turned On in your config.inc.php configuration file; that’s a deprecated setting, known not to work 100%, and it’s been removed from 3.4.0 and newer. I’d suggest getting your web server set up so that disable_path_info is not required, and the other problems you’re encountering should go away.

Regards,
Alec Smecher
Public Knowledge Project Team