Wordpress Problem with timthumb security

I migrated an older site over to centminmod recently and discovered one of the galleries not working properly. I have already double checked the chown folders confirming nginx:nginx

When I checked the gallery images, I see the images not loaded from this url, nginx returns 403 Forbidden

Code:

http://site.com/wp-content/plugins/media-grid/classes/timthumb.php?src=/home/nginx/domains/site.com/public/wp-content/uploads/imagefile.jpg&w=275&h=275&a=c&q=85&zc=1&cc=FFFFFF

The log file says: "access forbidden by rule"
How can i find what rule? Does anyone have an idea?

---

Code:

2016/01/26 19:09:52 [error] 2818#2818: *1016 access forbidden by rule, client: 1.1.1.1, server: site.com, request: "GET /wp-content/plugins/media-grid/classes/timthumb.php?src=/home/nginx/domains/site.com/public/wp-content/uploads/IMGP7920.jpg&w=275&h=275&a=c&q=85&zc=1&cc=FFFFFF HTTP/1.1", host: "site.com", referrer: "http://site.com/about-bio/"
2016/01/26 19:09:52 [error] 2818#2818: *1017 access forbidden by rule, client: 1.1.1.1, server: sharonehakman.com, request: "GET /wp-content/plugins/media-grid/classes/timthumb.php?src=/home/nginx/domains/site.com/public/wp-content/uploads/IMG_8579.jpg&w=275&h=275&a=c&q=85&zc=1&cc=FFFFFF HTTP/1.1", host: "site.com", referrer: "http://site.com/about-bio/"

 

Thanks for the advice, that did the trick, although the instructions in the referenced thread need to be updated.

I had to put the exception near the top of the file for it to work, not above the section per the other post. My wpsecure_domain.com.conf now looks like below. I will cross post to the other thread as well, since it was confusing.

Code:

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
location ~* /(?:uploads|files)/.*\.php$ {
deny all;
}

#Exception for mediagrid timthumb
location ~ ^/wp-content/plugins/media-grid/classes/ {
  include /usr/local/nginx/conf/php.conf;
}

# Block PHP files in content directory.
location ~* /wp-content/.*\.php$ {
  deny all;
}

# Block PHP files in includes directory.
location ~* /wp-includes/.*\.php$ {
  deny all;
}

# Block PHP files in uploads, content, and includes directory.
location ~* /(?:uploads|files|wp-content|wp-includes)/.*\.php$ {
  deny all;
}

# Make sure files with the following extensions do not get loaded by nginx because nginx would display the source code, and these files can contain PASSWORDS!
location ~* \.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|\.php_
{
return 444;
}

#nocgi
location ~* \.(pl|cgi|py|sh|lua)$ {
return 444;
}

#disallow
location ~* (w00tw00t) {
return 444;
}

location ~* /(\.|wp-config\.php|wp-config\.txt|changelog\.txt|readme\.txt|readme\.html|license\.txt) { deny all; }