0

Edit: I have only just taken over management of this part-completed site, which was copied over from shared hosting install to a VPS. Some configuration might be slightly wrong - I'm not sure, yet

Update1: I seem to have fixed the looping 'Access Denied' problem. The .htaccess, shown below, was in public_html/ but seems to have been created by Front Page. There was an additional .htaccess in public_html/temp/ (where Drupal is temporarily installed). Adding RewriteBase /temp to that htaccess fixed part of the issue.

I seem to be getting some sort of loop happening on my Drupal 7 installation.

Occasionally on basic pages which don't require authorisation I get multiple lines of 'Access Denied: Please login' . (see Update1)

Pages that are restricted to authorised users should redirect non-authorised (anon.) users to login/register - but at the minute it fails with a redirect loop (ie: if I visit {domain}.co.uk/admin before logging in I fail with a redirect loop).

Also I seem to be having a problem switching between https and http pages. - I think this is the main issue

Here are some details:

  • SSL configured for www.{mydomain}.co.uk
  • Site does not rewrite {domain}.co.uk to www.{domain}.co.uk
  • Module: URL alias disabled (until fixed this)
  • Module: URL rewrite disable (until fixed this)
  • Module: SecureLogin was installed but now disabled.
  • (update) Module: Ubercart SSL causes 302 on ALL pages (may be relevant)

HTTP Virtual Host

NameVirtualHost ***.***.***.***:80

<VirtualHost ***.***.***.***:80>
    ServerName {domain}.co.uk
    ServerAlias www.{domain}.co.uk
    DocumentRoot /home/{user}/public_html
    ServerAdmin {user}@{domain}.co.uk
    UseCanonicalName Off
    CustomLog /usr/local/apache/domlogs/{domain}.co.uk combined
    CustomLog /usr/local/apache/domlogs/{domain}.co.uk-bytes_log "%{%s}t %I .\n%{%s}t %O ."
    ScriptAlias /cgi-bin/ /home/{user}/public_html/cgi-bin/    
</VirtualHost>

HTTPS Virtual Host

<VirtualHost ***.***.***.***:443>
    ServerName {domain}.co.uk
    ServerAlias www.{domain}.co.uk
    DocumentRoot /home/{user}/public_html
    ServerAdmin {user}@{domain}.co.uk
    UseCanonicalName Off
    CustomLog /usr/local/apache/domlogs/{domain}.co.uk combined
    CustomLog /usr/local/apache/domlogs/{domain}.co.uk-bytes_log "%{%s}t %I .\n%{%s}t %O ."
    ScriptAlias /cgi-bin/ /home/admin/public_html/cgi-bin/
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/www.{domain}.co.uk.crt
    SSLCertificateKeyFile /etc/ssl/private/www.{domain}.co.uk.key
    SSLCACertificateFile /etc/ssl/certs/www.{domain}.co.uk.cabundle
    CustomLog /usr/local/apache/domlogs/{domain}.co.uk-ssl_log combined
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
<Directory "/home/{user}/public_html/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
</VirtualHost>

HTACCESS file (site root) - now deleted see Update1

##RewriteEngine On  //temporarily disabled until issue fixed
##RewriteCond %{HTTP_HOST} !^www.{domain}\.co\.uk$ [NC]  //temporarily disabled until issue fixed
##RewriteRule (.*) http://www.{domain}.co.uk/$1 [R=301,L]  //temporarily disabled until issue fixed

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
 order deny,allow
 deny from all
 allow from all
</Limit>

<Limit PUT DELETE>
 order deny,allow
 deny from all
</Limit>

HTTPS Drupal root (public_html/temp/)

#
# Apache/PHP/Drupal settings:
#

# Protect files and directories from prying eyes.
<FilesMatch "\.    (engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?    |xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$">
  Order allow,deny
</FilesMatch>

# Don't show directory listings for URLs which map to a directory.
Options -Indexes

# Follow symbolic links in this directory.
Options +FollowSymLinks

# Make Drupal handle any 404 errors.
ErrorDocument 404 /index.php

# Set the default handler.
DirectoryIndex index.php index.html index.htm

# Override PHP settings that cannot be changed at runtime. See
# sites/default/default.settings.php and drupal_environment_initialize() in
# includes/bootstrap.inc for settings that can be changed at runtime.

# PHP 5, Apache 1 and 2.
<IfModule mod_php5.c>
  php_flag magic_quotes_gpc                 off
  php_flag magic_quotes_sybase              off
  php_flag register_globals                 off
  php_flag session.auto_start               off
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_flag mbstring.encoding_translation    off
</IfModule>

# Requires mod_expires to be enabled.
<IfModule mod_expires.c>
  # Enable expirations.
  ExpiresActive On

  # Cache all files for 2 weeks after access (A).
  ExpiresDefault A1209600

  <FilesMatch \.php$>
    # Do not allow PHP scripts to be cached unless they explicitly send cache
    # headers themselves. Otherwise all scripts would have to overwrite the
    # headers set by mod_expires if they want another caching behavior. This     may
    # fail if an error occurs early in the bootstrap process, and it may     cause
    # problems if a non-Drupal PHP file is installed in a subdirectory.
    ExpiresActive Off
  </FilesMatch>
</IfModule>

# Various rewrite rules.
<IfModule mod_rewrite.c>
  RewriteEngine on

  # Block access to "hidden" directories whose names begin with a period.     This
  # includes directories used by version control systems such as Subversion or
  # Git to store control files. Files whose names begin with a period, as     well
  # as the control files used by CVS, are protected by the FilesMatch     directive
  # above.
  #
  # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it     is
  # not possible to block access to entire directories from .htaccess,     because
  # <DirectoryMatch> is not allowed here.
  #
  # If you do not have mod_rewrite installed, you should remove these
  # directories from your webroot or otherwise protect them from being
  # downloaded.
  RewriteRule "(^|/)\." - [F]

  # If your site can be accessed both with and without the 'www.' prefix, you
  # can use one of the following settings to redirect users to your     preferred
  # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:
  #
  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/... will be redirected to http://www.example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
  # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  #
  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/... will be redirected to http://example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301]

  # Modify the RewriteBase if you are using Drupal in a subdirectory or in a
  # VirtualDocumentRoot and the rewrite rules are not working properly.
  # For example if your site is at http://example.com/drupal uncomment and
  # modify the following line:
  RewriteBase /temp
  #
  # If your site is running in a VirtualDocumentRoot at http://example.com/,
  # uncomment the following line:
  # RewriteBase /

  # Pass all requests not referring directly to files in the filesystem to
  # index.php. Clean URLs are handled in drupal_environment_initialize().
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteCond %{REQUEST_URI} !^/php/.*$
  RewriteRule ^ index.php [L]

  # Rules to correctly serve gzip compressed CSS and JS files.
  # Requires both mod_rewrite and mod_headers to be enabled.
  <IfModule mod_headers.c>
    # Serve gzip compressed CSS files if they exist and the client accepts     gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]

    # Serve gzip compressed JS files if they exist and the client accepts     gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]

    # Serve correct content types, and prevent mod_deflate double gzip.
    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]

    <FilesMatch "(\.js\.gz|\.css\.gz)$">
      # Serve correct encoding type.
      Header set Content-Encoding gzip
      # Force proxies to cache gzipped & non-gzipped css/js files separately.
      Header append Vary Accept-Encoding
    </FilesMatch>
  </IfModule>
</IfModule>
4
  • Try going to admin/reports/status/rebuild and rebuilding all permissions.
    – Bisonbleu
    Mar 27, 2013 at 13:03
  • I have just rebuilt the permissions and am still having the same problem.
    – kaipee
    Mar 27, 2013 at 15:57
  • I seem to have fixed the looping 'Access Denied' problem. The first .htaccess was in public_html/ but seems to have been created by Front Page. There was an additional .htaccess in public_html/temp/ (where Drupal is temporarily installed). Adding RewriteBase /temp to that htaccess fixed part of the issue.
    – kaipee
    Mar 27, 2013 at 16:45
  • UPDATE: there was a custom 403 page (which I had no idea existed previously) which was causing redirect loops. I have updated the PHP code which now correctly redirects to a login page. The only problem I now have is switching to HTTPS and back again (currently loads my new 403 page)
    – kaipee
    Apr 4, 2013 at 9:42

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.