1

after moving to new server, i started to get 403 on the following link...any help?

http://www.mywebsite.com/redirect/89431/?url=http://www.externalWebSite.com/blog/2014/10/05/

the goal is to redirect the user to the external website.

below is the module (even i dont think the problem is from it)

<?php

function redirect_menu() {
    $items = array();
    $items['redirect/%'] = array(
        'title' => 'Go To URL',
        'page callback' => 'page_redirect',
        'page arguments' => array(1,2),
        'access arguments' => array('access content'),
        'type' => MENU_CALLBACK,
     );
    return $items;
}
function page_redirect($arg1) {
    $nid = $arg1;
    if (is_numeric($nid)) {
        if(node_load($nid)){
        db_merge('node_counter')
          ->key(array('nid' => $nid))
          ->fields(array(
            'daycount' => 1,
            'totalcount' => 1,
            'timestamp' => REQUEST_TIME,
          ))
          ->expression('daycount', 'daycount + 1')
          ->expression('totalcount', 'totalcount + 1')
          ->execute();
        }
    }
    if (isset($_GET['url'])){
        drupal_goto($url);
    }
}

?>

NOTE: THE FOLLOWING DO NOT GIVE 403 ERROR (NOTE AFTER THE http in the query string):

http://www.mywebsite.com/redirect/89431/?url=http//www.externalWebSite.com/blog/2014/10/05/

http://www.mywebsite.com/redirect/89431/?url=http:/www.externalWebSite.com/blog/2014/10/05/

3
  • 1
    Do you have mod_security enabled in Apache?
    – AKS
    Jan 11, 2015 at 18:50
  • thx for showing me the light :) ... that solved the problem. it seems that hostgator has enabled the mod_security and stopped any "http://" in form data ("Remote File Injection attempt in ARGS (MM)") ... found this after googling about mod_security forums.hostgator.com/mod-security-and-403-errors-t71394.html
    – Zorox
    Jan 11, 2015 at 19:15
  • Good to hear that. There is also a risk of Open Redirect. IMHO, mod_security is good enough to detect the dumbest security errors, and when you have taken care of the basic security, mod_security just gets in your way.
    – AKS
    Jan 11, 2015 at 19:18

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.