/ Register

Want to subscribe to topics you're interested in?
Become a Member

403 Forbidden / Invalid MIME

Discussion in 'Blogs & CMS usage' started by JamesJamz, Oct 20, 2020.

Previous Thread Next Thread
Loading...
  1. Oct 20, 2020 #1
    JamesJamz

    JamesJamz New Member

    21
    2
    3
    May 4, 2020
    UK
    Ratings:
    +3
    Local Time:
    4:38 AM
    10.4
    Hi All,
    Just testing a theme I've downloaded on Centmin Mod, its lightning fast, however the only issue I seem to be having at the moment is that the theme has a dynamically driven css file, that enqueues a PHP file (with a content header of text/css output).

    When going to the URL on the site, I get a 403 forbidden
    Dir: /wp-content/themes/themename/assets/css/dynamic-css.php

    I've checked through all the nginx config files, and I cannot for the life of me see any rules relating to the /theme/ being blocked from direct access?

    Where am I going wrong? - Or is it due to the mime type being a PHP file but outputting css?
     
  2. Oct 20, 2020 #2
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    1:38 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Centmin Mod values security and puts additional measures in place so that end users are also mindful of security. So in your case, you might need to whitelist or unblock the WP plugins related to your 403 permission denied messages.

    If you used centmin.sh menu option 22 auto installer Wordpress Nginx Auto Installer, the default wpsecure conf file at /usr/local/nginx/conf/wpincludes/${vhostname}/wpsecure_${vhostname}.conf where vhostname is your domain name, blocks php scripts from executing in wp-content for security

    Below links you can see examples of setting up specific wordpress location matches to punch a hole in the wpsecure blocking to whitelist specific php files that need to be able to run.

    If on Centmin Mod 123.09beta01, you may have ran into the new tools/autoprotect.sh cronjob feature outlined at Beta Branch - autoprotect.sh - apache .htaccess check & migration to nginx deny all | Centmin Mod Community You uploaded scripts may have .htaccess deny from all type files in their directories which may need bypassing autoprotect. It's a security feature that no other nginx based stack has as far as I know :)

    So instead, all .htaccess 'deny from all' detected directories now get auto generated Nginx equivalent location match and deny all setups except if you want to manually bypass the directory from auto protection via a .autoprotect-bypass file - details below here.

    You can read a few threads below on how autoprotect.sh may have caught some folks web apps falsely and the workarounds or improvements made to autoprotect.sh with the help of users feedback and troubleshooting.
    Check if your nginx vhost at either or both /usr/local/nginx/conf/conf.d/domain.com.conf and/or /usr/local/nginx/conf/conf.d/domain.com.ssl.conf has include file for autoprotect example
    Code (Text):
    include /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf;

    see if your directory for the script which has issues is caught in an autoprotect include entry in /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf which has a deny all entry
    Code (Text):
    cat /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf

    i.e.
    Code (Text):
    # /home/nginx/domains/domain.com/public/subdirectory/js
location ~* ^/subdirectory/js/ { allow 127.0.0.1; deny all; }

    If caught you can whitelist it by autoprotect bypass .autoprotect-bypass file - details below here. So if problem js file is at domain.com/subdirectory/js/file.js then it is likely /subdirectory/js has a .htaccess with deny all in it - make sure that directory is meant to be publicly accessible by contacting author of script and if so, you can whitelist it and re-run autoprotect script to regenerate your /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file
    Code (Text):
    cd /home/nginx/domains/domain.com/public/subdirectory/js
touch .autoprotect-bypass
/usr/local/src/centminmod/tools/autoprotect.sh
nprestart

    it maybe you need to also whitelist /subdirectory then it would be as follows creating bypass files at /home/nginx/domains/domain.com/public/subdirectory/.autoprotect-bypass and /home/nginx/domains/domain.com/public/subdirectory/js/.autoprotect-bypass
    Code (Text):
    cd /home/nginx/domains/domain.com/public/subdirectory/
touch .autoprotect-bypass
cd /home/nginx/domains/domain.com/public/subdirectory/js
touch .autoprotect-bypass
/usr/local/src/centminmod/tools/autoprotect.sh
nprestart

    then double check to see if updated /usr/local/nginx/conf/autoprotect/domain.com/autoprotect-domain.com.conf include file now doesn't show an entry for /subdirectory/js
     
  3. Oct 20, 2020 #3
    JamesJamz

    JamesJamz New Member

    21
    2
    3
    May 4, 2020
    UK
    Ratings:
    +3
    Local Time:
    4:38 AM
    10.4
    Thank you for pointing me in the right direction, post was very helpful.

    Managed to get it working now, had to move it near the top of the list to get it working

    Code (Text):
    # Allow PHP Dynamic CSS File
location ~ ^/wp-content/themes/listingpro/assets/css/ {
  include /usr/local/nginx/conf/php.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
}

# Block PHP files in content directory.
location ~* /wp-content/.*\.php$ {
  deny all;
}

# Block PHP files in includes directory.
location ~* /wp-includes/.*\.php$ {
  deny all;
}

# Block PHP files in uploads, content, and includes directory.
location ~* /(?:uploads|files|wp-content|wp-includes)/.*\.php$ {
  deny all;
}

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
return 444;
}

location ~* \.(tpl)$
{
  deny all;
}

#nocgi
location ~* \.(pl|cgi|py|sh|lua)$ {
return 444;
}

#disallow
location ~* (w00tw00t) {
return 444;
}

location ~* /(\.|wp-config\.php|wp-config\.txt|changelog\.txt|readme\.txt|readme\.html|license\.txt) { deny all; }
     
  4. Oct 20, 2020 #4
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    1:38 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Good to know. Might seem like more work, though it allows you to control which Wordpress plugins have PHP executing permissions just to be more secure :)
     
Previous Thread Next Thread
Loading...

.