0

I'm trying to install the Breezing Forms extension (free) but I'm getting the following error when I try to upload the com_breezingforms_lite.zip:

Forbidden

You don't have permission to access /administrator/index.php on this server.

=============
System Information
=============
php: Linux lxb03006 2.6.18-417.el5.secure #1 SMP Wed Jan 11 09:47:21 EST 2017 i686
dbversion: 5.1.69-log
dbcollation: utf8_general_ci
dbconnectioncollation: utf8_general_ci
phpversion: 5.6.30
server: Apache/2
sapi_name: cgi-fcgi
version: Joomla! 3.7.2 Stable [ Amani ] 22-May-2017 09:46 GMT
platform: Joomla Platform 13.1.0 Stable [ Curiosity ] 24-Apr-2013 00:00 GMT

Please note that I don't have sudo rights on this server.

Please note that this question has been cross-posted at StackOverflow: https://stackoverflow.com/questions/44870665/joomla-extension-installation-no-permission-to-access-administrator-index-php

.htaccess:

##
# @package    Joomla
# @copyright  Copyright (C) 2005 - 2016 Open Source Matters. All rights reserved.
# @license    GNU General Public License version 2 or later; see LICENSE.txt
##

##
# READ THIS COMPLETELY IF YOU CHOOSE TO USE THIS FILE!
#
# The line 'Options +FollowSymLinks' may cause problems with some server configurations.
# It is required for the use of mod_rewrite, but it may have already been set by your 
# server administrator in a way that disallows changing it in this .htaccess file.
# If using it causes your site to produce an error, comment it out (add # to the 
# beginning of the line), reload your site in your browser and test your sef urls. If 
# they work, then it has been set by your server administrator and you do not need to 
# set it here.
##

## No directory listings
IndexIgnore *

## Can be commented out if causes errors, see notes above.
Options +FollowSymlinks
Options -Indexes

## Mod_rewrite in use.

RewriteEngine On

## Begin - Rewrite rules to block out some common exploits.
# If you experience problems on your site then comment out the operations listed 
# below by adding a # to the beginning of the line.
# This attempts to block the most common type of exploit `attempts` on Joomla!
#
# Block any script trying to base64_encode data within the URL.
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
# Block any script that includes a <script> tag in URL.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block any script trying to set a PHP GLOBALS variable via URL.
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block any script trying to modify a _REQUEST variable via URL.
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Return 403 Forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
#
## End - Rewrite rules to block out some common exploits.

## Begin - Custom redirects
#
# If you need to redirect some pages, or set a canonical non-www to
# www redirect (or vice versa), place that code here. Ensure those
# redirects use the correct RewriteRule syntax and the [R=301,L] flags.
#
## End - Custom redirects

##
# Uncomment the following line if your webserver's URL
# is not directly related to physical file paths.
# Update Your Joomla! Directory (just / for root).
##

# RewriteBase /

## Begin - Joomla! core SEF Section.
#
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#
# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]
#
## End - Joomla! core SEF Section.

htaccess.txt

##
# @package    Joomla
# @copyright  Copyright (C) 2005 - 2017 Open Source Matters. All rights reserved.
# @license    GNU General Public License version 2 or later; see LICENSE.txt
##

##
# READ THIS COMPLETELY IF YOU CHOOSE TO USE THIS FILE!
#
# The line 'Options +FollowSymLinks' may cause problems with some server configurations.
# It is required for the use of mod_rewrite, but it may have already been set by your 
# server administrator in a way that disallows changing it in this .htaccess file.
# If using it causes your site to produce an error, comment it out (add # to the 
# beginning of the line), reload your site in your browser and test your sef urls. If 
# they work, then it has been set by your server administrator and you do not need to 
# set it here.
##

## No directory listings
<IfModule autoindex>
  IndexIgnore *
</IfModule>

## Can be commented out if causes errors, see notes above.
Options +FollowSymlinks
Options -Indexes

## Mod_rewrite in use.

RewriteEngine On

## Begin - Rewrite rules to block out some common exploits.
# If you experience problems on your site then comment out the operations listed 
# below by adding a # to the beginning of the line.
# This attempts to block the most common type of exploit `attempts` on Joomla!
#
# Block any script trying to base64_encode data within the URL.
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
# Block any script that includes a <script> tag in URL.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block any script trying to set a PHP GLOBALS variable via URL.
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block any script trying to modify a _REQUEST variable via URL.
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Return 403 Forbidden header and show the content of the root home page
RewriteRule .* index.php [F]
#
## End - Rewrite rules to block out some common exploits.

## Begin - Custom redirects
#
# If you need to redirect some pages, or set a canonical non-www to
# www redirect (or vice versa), place that code here. Ensure those
# redirects use the correct RewriteRule syntax and the [R=301,L] flags.
#
## End - Custom redirects

##
# Uncomment the following line if your webserver's URL
# is not directly related to physical file paths.
# Update Your Joomla! Directory (just / for root).
##

# RewriteBase /

## Begin - Joomla! core SEF Section.
#
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#
# If the requested path and file is not /index.php and the request
# has not already been internally rewritten to the index.php script
RewriteCond %{REQUEST_URI} !^/index\.php
# and the requested path and file doesn't directly match a physical file
RewriteCond %{REQUEST_FILENAME} !-f
# and the requested path and file doesn't directly match a physical folder
RewriteCond %{REQUEST_FILENAME} !-d
# internally rewrite the request to the index.php script
RewriteRule .* index.php [L]
#
## End - Joomla! core SEF Section.

.user.ini

magic_quotes_gpc = Off 
3
  • Have you modified any of the core Joomla files or are you using any security extensions such as Admin Tools?
    – Lodder
    Commented Jul 2, 2017 at 12:36
  • Not that I'm aware of. The following admin extensions are installed: Administrator Menu, Administrator Sub-Menu, Hathor Administrator template, Isis Administrator template, SP Page Builder Admin Menu
    – Puce
    Commented Jul 2, 2017 at 12:42
  • Please note that I've just updated Joomla! 3.7.2 It might be related, because I think I've use that extension upload page before.
    – Puce
    Commented Jul 2, 2017 at 12:47

2 Answers 2

0

First of all check the file permissions on the server. If everything is correct, then it may be something in your .htaccess or other security restrictions on the server - mod_security likely.

Your hosting provider may be of help with this as well.

Update

Well, to see about the mod_security, the easiest way would be to contact your hosting provider. Actually it may be the only way to find out about it, especially if they don't give access at the cPanel level of it.

If you want to find out if it is enabled, you can use the apache_get_modules function to get an array with the apache modules - works with apache - not sure what's the case if server is litespeed.

Also note that with WHM/cPanel hosting, the provider may have enabled the mod_security and also give option to the cPanel account to enable/disable it. If so, you can disable it for a while to see if your issue really comes from mod_security. It may also be possible that cPanel user have access to the rules and the monitoring (logs). In this case you can search the logs for entries pertaining to your IP, find out the rule that restricts you and disable it.

8
  • The only permission which I could find that seemd odd was configuration.php (it was read-only and I set it now to writable). I can access the Control Panel at http://<my-site>/administrator/index.php
    – Puce
    Commented Jul 2, 2017 at 12:46
  • @Puce it's fine with keeping configuration.php with 444 permissions. If anything else doesn't work, just check for mod_security - it's very likely that a rule that might be blocking the upload/installation of extensions.
    – FFrewin
    Commented Jul 2, 2017 at 12:48
  • How can I check mod_security and what should I be looking for?
    – Puce
    Commented Jul 2, 2017 at 12:54
  • I've updated the question with the htaccess files.
    – Puce
    Commented Jul 2, 2017 at 12:55
  • @Puce - .htaccess seems ok - it's the core one that ships with Joomla. I also updated my answer to include some additional info about mod_security.
    – FFrewin
    Commented Jul 2, 2017 at 13:54
0

Work-around that worked:

  • unzip com_breezingforms_lite.zip
  • upload the folder to the server (e.g. via FTP)
  • use the option to install from a local directory
1
  • this is not a work-around - is one of the available installation options in Joomla Extension Installer. However, I would first upload the zip file, then unzip it on the server. Faster and less chances to end-up with corrupted files - as it's only 1 file upload. Have you checked with the hosting provider and especially for mod_security?
    – FFrewin
    Commented Jul 3, 2017 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.