'Forbidden' message when saving ticket with image

LesD

We recently upgraded to 1.18.1 and also moved hosting from our own server to a cloud shared server, so not sure of the source of this problem.

Creating a ticket as a regular user: Paste a snipped image into the ticket text box. Then submit the ticket and get error:
Forbidden
You don't have permission to access this resource.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

When logged in as an Agent and I create a ticket, there is no error message and the ticket is created.

Any suggestions as to cause?

Thanks.

LesD

If I attach the image or file then its ok.

I have also discovered that its only on a new ticket that this happens.

Adding an image to an existing ticket is OK.

KevinTheJedi

LesD

You need to look at your webserver error logs to see the reason why it's forbidden. Your host may have specific rules enabled that's blocking this, you could have incorrect permissions, you could have a borked site config, etc.

Cheers.

LesD

Those were my initial thoughts as well, but the symptoms don't seem to fit a hosting issue.

Why should adding a new ticket as Agent work but not as a user?
Why should the new ticket fail but an update to the ticked not fail?

I'll try and get to some logs but the symptoms seem more likely to point to something relating to a new ticket from a user.

For a User, a new ticket is done in open.php while for an Agent its tickets.php and updating for everyone is also tickets.php. So it looks like open.php is doing things with pasted images in a different way from tickets.php.

KevinTheJedi

LesD

You'll just have to check your logs for a reason why as there is no telling. The form for creating a new ticket as a User and Agent are relatively the same minus the fact that the Agents have a little more options.

Cheers.

LesD

The people hosting the site (Namecheap) have identified the issue as being a block by their ModSecurity module.

They have added some whitelisting entry and the problem has gone away.

They gave me a link to their KB on the subject. There it mentions:

It comes with a Core Rule Set (CRS) which has various rules for:
cross website scripting
bad user agents
SQL injection
trojans
session hijacking
other exploits

So it seems that the open.php page is definitely dealing with a pasted in image in a different way than in ticket.php.

KevinTheJedi

LesD

I knew it, thanks for posting.

Cheers.

LesD

Does that mean that its likely to be changed?

KevinTheJedi

LesD

In v2.0 everything will change but in current codebase no. Your host needs to modify there rules. NameCheap is a common host for such strict security rules. You will need to ask your host to change this (or simply use a different host without such rules); not osTicket.

Cheers.

LesD

Thanks - Its OK. They have done whatever whitelist is necessary so its all working.