Fancy Upload Fail

[Ben_360fusion]

Hi,

I have a really wierd problem and dont know if it is typolight, my pc or a server related issue.

I uploaded a clients site to Typolight 2.8 and all was well. Then they discovered they could upload images with fancy upload. I checked on my pc and sure enough i couldn't either. Then i checked on another pc and i could. so It isn't a tyoplight or server problem with the site but a local one.

So I then tried to upload the same image from my pc to another typologht website on a different server and could. I can also uload from my pc to a WAMP instalation locally from my PC so it isn't a local pc problem.

So if it isn't an issue related to my pc as i can upload to other typolight installations and It isn't a server issue as one pc in the office can upload to the typolight installation on the server i can't upload to what is it.

I have search Fancyupload forums, been on to the hosting company support and am stuck.

Has anyone else had similar problems or ideas of what could be casuing it?

Thanks
Ben

[leo]

Make sure you have the latest Flash version, clear your browser cache and then restart the browser.

[Ben_360fusion]

Hi Leo,

Yep, tried all that, have lastest flash, tried on firefox, chrome and IE but no joy with this site on this server. I can upload from same PC to another site on a different server fine.

I'm stumped as I can upload to this site from another PC in my office no trouble.

I'm on Vista 64 and other PC is XP SP3.

[leo]

It seems to be a server problem then (at least this was reported in the German community). Which OS is the server running on?

[Ben_360fusion]

It's on: CentOS release 4.8 (Final)

[Ben_360fusion]

Just spent another hour online with hosing company chat support.

Think it may be fixed, I can now upload off my laptop. will test on office PC again tomorrow.

Hosts said they have disabled mod security

I thought this was already in my .htaccess file though:

SecFilterEngine Off
SecFilterScanPOST Off

[leo]

I have forwarded this information to the German community.

[Ben_360fusion]

Cool, I have tested in in my office and it works fine from my pc here too.

Glad to get that one sorted as it's a great new feature.

[leo]

The thread in the German forum is 3 pages long and the problem has been discussed for weeks. It is amazing how quickly you have tracked it down :D

[zag]

I'm having something similar . . . I think.

I haven't had to upload any files recently, but when I tried today (following an upgrade to 2.8.0 a while back) the server returned a HTTP 403 indicating an authentication failure. When I tried to browse somewhere else on the site I got an error from the hosting provider indicating that my IP address had been blocked because of failed authentications. This block stops me even browsing to the front end.

I've asked the ISP to unblock the address and meantime I'm trying to work out what the problem is so that when I get back in I can have a go at fixing it.

I had a look at the post in the German forum, but since I don't understand German it didn't make much sense to me

Can someone let me know if this is an issue with a known fix and/or if I need to do the changes from below - "disabled mod security" & add these to .htaccess file - SecFilterEngine Off, SecFilterScanPOST Off.

Alternatively, is there a way to revert to the old upload engine - at least that way I could update the site.

Cheers,

z

[FloB]

Old uploader can be activated (resp. FancyUpload deactivated) in the settings.

Did you protect your backend with a .htaccess? Then you need to exclude the upload.php from this protection as flash can't handle HTTP Auth.

[zag]

Did you protect your backend with a .htaccess? - unknown - I inherited the site from someone and haven't quite worked out what's what. I will make the changes you suggest (when the hoster unblocks me) and see what happens.

Thanks,

z

[FloB]

Either there will be an addition to the root's .htaccess or there is another one in the /typolight/ folder which simply adds a HTTP Auth. There might also be an option set in levels above the typolight folder.

[zag]

OK guys, I'm going to ask for the real beginners version of the suggestions. I'm back in to the site, but I'm struggling to find where to make the changes above.

Option 1 - exclude main.php from access protection - I don't see a .htaccess file in the same directory as main.php. I could create one with just the entry below from this page - http://dev.typolight.org/issues/show/1288 - but I'm a little concerned this will break something else, and with my security hat on I don't feel too good about excluding a file from access control as a work around. I'll do it if necessary, but if I can do it another way it would be good.

<FilesMatch "main\.php$">
Satisfy Any
Order allow,deny
Allow from all
</FilesMatch>

Option 2 - turn off fancyupload and use the old one - imagine for a moment that I haven't had to do much with the config files previously because the backend does so much already - can anyone tell me where I can turn it off and where I can turn the old one back on again ?

Cheers,

z

[zag]

Option 3 from the fancyupload site - http://digitarald.de/project/fancyupload/ -

If you are using Apache with mod_security this will not work, you need to put the following in your .htaccess file to disable mod_security:

SecFilterEngine Off SecFilterScanPOST Off

Disabling mod_security isn’t allowed on some shared hosts, and only do this if you know what you are doing. This is due to a bug in the way that flash sends the headers back to the server according to the Flash 8 documentation

[FloB]

Did you try to disable

SecFilterEngine Off
SecFilterScanPOST Off

for the upload.php or the complete backend / installation?

To disable FancyUpload, go to the settings page in the backend and untick "Activate FancyUpload …" (I'm not quite sure how this is named in the english version, but it should start with those words).

The following only applies if another layer of security was added by using a HTTP Auth method (not using this method should not infringe your installation's security and is mostly not necessary but recommended for sites which require high security standards (although this method won't raise the security standard that much higher), with many visitors and/or those who are known to be possible hacking victims):
You shouldn't exclude main.php but upload.php. Losening protection for just this file is neglectable as it can only be accessed via special parameters and is only used for uploading files via FancyUpload. Trying to access it directly without being logged on to the backend will redirect you to the main page (which in return is protected anyway).

[zag]

Thanks - I just went in and disabled fancyupload and all is working well again.

I didn't make any changes to the permissions anywhere as I still wasn't sure of what I was doing. I still can't find any .htaccess file anywhere on the site and from what I can see I don't have access to the apache config on the hosted service I use. I could create .htaccess files but for the moment I think that just not using fancyupload is a more guaranteed result for me.

Thanks for the help.

z

[FloB]

No .htaccess means no losening security. Though you should try the Sec* options. If it's still not working, please report this so we can try to fix the problem.

[Ben_360fusion]

I have updated a site to 2.8.1 and now I can't upload again. I have the SecFilterEngine Off SecFilterScanPOST Off in my htaccess file but it doesn't have any affect anymore.

I have sites on the same sharded hosting server which still work, the only difference i can think of is that i just upgraded to 2.8.1

I have also updated a site on WAMP loaclly to 2.8.1 and it is uploading fine.

Will look into it some more.

Ben

[PaoloB]

Hi
I too have this problem

On my server (centos 5.4) i have install the demo of the FancyUpload and this works correctly

On the file TL_ROOT\system\config\fancyUpload.php in the line 130 i have replaced the line

file.info.set('html', json.get('message'));

with

file.info.set('html', 'An error occured: ' + (json.get('error') ? (json.get('error') + ' #' + json.get('code')) : response));

I have upload one file and i have this error on
An error occured: location.replace("http://mysite/typolight/index.php")

Any ideas?

thanks

[evantro]

Hello

When I add the following lines in the .htaccess file I got the error message:

• SecFilterEngine Off
  SecFilterScanPOST Off

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@mydomain.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

what's wrong ?

[FloB]

Either, you're not allowed to set these options, or you cannot set those settings at all because of a missing Apache httpd module.