[upgrade] 4.1.2 to 4.2.0 issue with .htaccess #10913

raramuridesign · 2022-03-01T16:14:55Z

Mautic Version

4.2.x series

PHP version

7.4.27

What browsers are you seeing the problem on?

Firefox, Chrome

What happened?

After performing an upgrade, the site reports an error 403, forbidden.

We upgrade via command line and clear cache and clean permissions as part of the process.

This maybe server specific, but this line in the HTACCESS

https://github.com/mautic/mautic/blob/4.2.0/.htaccess

# Apache 2.4+
<IfModule authz_core_module>
    # Deny access via HTTP requests to all PHP files.
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>

Causes the issue, by commenting out

<FilesMatch "\.php$">
        Require all denied
    </FilesMatch>

The site loads again.

Prior to this verison 4.1.2 Worked with this in the htaccess file.

How can we reproduce this issue?

Server
Ubunto 18.04.4 LTS
Server API | FPM/FastCGI
MariaDB
1:10.2.43+maria~bionic
Apache
2.4.52-1+ubuntu18.04+1
NGiNX
1.19.9-1+ubuntu18.04+1

Not sure if this is important, but we have mautic in a subfolder off the domain
eg: domain.com/mautic/

Relevant log output

n/a

Code of Conduct

I confirm that I have read and agree to follow this project's Code of Conduct

The text was updated successfully, but these errors were encountered:

RCheesley · 2022-03-01T16:26:13Z

@mollux any thoughts on this?

RCheesley · 2022-03-01T16:27:34Z

See also: https://forum.mautic.org/t/403-error-after-mautic-3-3-5-update/22859

mautibot · 2022-03-01T16:32:02Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/403-error-after-mautic-3-3-5-update/22859/5

raramuridesign · 2022-03-01T16:42:43Z

I have updated on 2 different servers
server one has the same setup except OS ubuntu 20
But mautic is on a domain like: https://mautic.maindomain.com

IE no subfolder, the update was smooth.

Second server is a WHM/CPANEL server the
Also has a subdomain as per the above, update worked without issues.

A note about the htaccess rule
.htaccess rule to deny all the files with .php extension so the index.php file will also be blocked by the rule so this causes a permission issue.

Perhaps it might be a good idea to exclude the index.php ?

M.

RCheesley · 2022-03-01T16:47:32Z

Thanks for the feedback/troubleshooting @raramuridesign - really helpful!

So to summarise this seems to be an issue when Mautic is in a sub-folder, rather than when it is in a root or subdomain?

Could you also confirm if those instances affected have the correct url rewrite settings (eg accessing mautic at domain.com/mautic/s/dashboard and not with an additional /index.php/ in the middle?

raramuridesign · 2022-03-01T16:56:21Z

@RCheesley the rewrite works on all the instances.

mollux · 2022-03-01T17:29:15Z

@raramuridesign @RCheesley

A subfolder in combination wit the .htaccess could indeed cause this issue.

Could you try to change following line in the .htaccess from
<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">

To

<If "%{REQUEST_URI} =~ m#^/mautic/(index|index_dev|upgrade/upgrade)\.php#">

raramuridesign · 2022-03-02T06:57:29Z

@mollux I can confirm this change works. However I did notice the folder: mautic is present based on my example. So I have adjusted for my use case.

I have also un-commented this line

<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

The only issue I see with this approach is

if the user has a different sub-folder name
if the htaccess is updated it could potentially overwrite this

What are your thoughts?
M

@RCheesley

mollux · 2022-03-02T07:09:50Z

@raramuridesign this was indeed purely an example, not something that needs to be committed in the repo.

There is no off the shelf fix for this, but it's something that needs to be tackled via documentation and awareness.
It depends on your setup (e.g. subfolder) if there are manual changes needed in your .htaccess after updating Mautic

@RCheesley what would be the best place to document this change? There is a different approach for tarball based and composer based installed

raramuridesign · 2022-03-02T07:13:54Z

@mollux Thanks and makes total sense with regards to documentation.
Question, how often is the .htaccess updated?

It might worth proving a full ideal .htaccess so users can see the different examples.
But when updates are performed, that the .htaccess is not touched.

Thoughts?

RCheesley · 2022-03-02T09:47:05Z

Thanks folks, @mollux I think this should be documented in the https://github.com/mautic/mautic-documentation repo. Probably under Installing Mautic / Updating Mautic and a link in the Troubleshooting section to those resources.

@raramuridesign we very rarely update htaccess, I think. The commit history is here: https://github.com/mautic/mautic/commits/4.x/.htaccess.

We do provide a full htaccess file right there in the repository, so I'm not sure what you're requesting, as the rules will be very specific for your own setup. We can't not update this file if there is a need to do so.

Maybe when we add to the docs we could give some examples for using Mautic in a folder, on a root domain, and in a subdomain as a starting point?

nikitakothari06 · 2022-03-02T11:09:56Z

@raramuridesign @RCheesley

A subfolder in combination wit the .htaccess could indeed cause this issue.

Could you try to change following line in the .htaccess from <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">

To

<If "%{REQUEST_URI} =~ m#^/mautic/(index|index_dev|upgrade/upgrade)\.php#">

Hi,

Yes. I have tried the solution too and it worked well on Apache 2.4 However it still gets stuck on Apache 2.2 The workaround for Apache 2.2 is still pending.

If Mautic 4.2.x requires minimum Apache 2.4 I would request Mautic team to update the requirement on Mautic website so that users don't get confused.
https://www.mautic.org/download/requirements

marcoalejandropalacio · 2022-03-02T13:31:55Z

Hello! I upgraded mautic 4.1.2 to 4.2.0 and it gave me 403 error.

Enter htaccess and modify line 113 of

to

And it worked correctly.

Will this cause any problems in the future?

RCheesley · 2022-03-02T13:35:28Z

@marcoalejandropalacio I have added the info to the release notes for the workaround which is mentioned here, and we are going to add it to the documentation in due course. This is likely because you are hosting in a folder rather than a subdirectory or root domain? If so you might want to use the workaround mentioned.

This should not present a problem in the future unless we update the htaccess file. Please always read the release notes before updating and we will make sure to be very clear if this file is being modified in future releases.

marcoalejandropalacio · 2022-03-02T13:46:43Z

I have the mautic installation in a subdomain.

@marcoalejandropalacio I have added the info to the release notes for the workaround which is mentioned here, and we are going to add it to the documentation in due course. This is likely because you are hosting in a folder rather than a subdirectory or root domain? If so you might want to use the workaround mentioned.

This should not present a problem in the future unless we update the htaccess file. Please always read the release notes before updating and we will make sure to be very clear if this file is being modified in future releases.

I have the mautic installation in a subdomain.

In my hosting the folders appear like this:

domains/mydomain.com/public_html/mautic

and the subdomain to access my mautic installation is mautic.mydomain.com

I hope that the solution that worked for me will help other people who have the same error

RCheesley · 2022-03-04T18:28:45Z

Hi folks, as this is a documentation issue relating to htaccess config I am going to close this issue - we will ensure that we provide clear warnings if we are updating the htaccess file in future releases, so please make sure you read the release notes!

github-actions · 2022-03-04T18:29:05Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If this issue is continuing with the lastest stable version of Mautic, please open a new issue that references this one.

nikitakothari06 · 2022-03-10T12:11:03Z

Hi,

The code for apache 2.2 still not working.

Please mention the exact syntax for apache 2.2 and 2.4 in well documented manner when the installation is made in a sub directory.

wilsonfe · 2022-03-28T19:55:16Z

Hello! I upgraded mautic 4.1.2 to 4.2.0 and it gave me 403 error.

Enter htaccess and modify line 113 of

<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade).php#">

to

<FilesMatch "^(index|index_dev|filemanager|upgrade).php$">

And it worked correctly.

Will this cause any problems in the future?

Did you do just that to make it work?

# Except those allowed below.
#<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">
#    Require all granted
#</If>

<FilesMatch "^(index|index_dev|filemanager|upgrade).php$">

In my case it didn't work.

wilsonfe · 2022-03-28T22:41:25Z

On my server mautic is installed in a subdomain and gave the same 403 problem.

I uninstalled everything and reinstalled version 4.2 and was unsuccessful as I had to comment out the code:

<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

So I was able to access, however, even informing the Amazon AWS SES access data, I can't connect, it gives an authentication error.

raramuridesign · 2022-03-29T07:12:00Z

@wilsonfe @nikitakothari06
I have written an explanation here
https://kb.raramuridesign.com/htaccess-tweak-for-mautic-in-a-subfolder.html
Hope this helps.

wilsonfe · 2022-03-29T09:21:26Z

@wilsonfe @nikitakothari06 I have written an explanation here https://www.raramuridesign.com/kb/articles/htaccess-tweak-for-mautic-in-a-subfolder.html

Hope this helps.

On my server mautic is installed in a subdomain email.mydomain.com and gave the same 403 problem.

raramuridesign · 2022-03-29T09:24:55Z

Did you try to uncomment this line - the link above will only work for subfolders. So first read through the thread logically to see where your issue is. Perhaps you have a permissions issue... I suppose you should also ask on the forum and post screenshots and setup so users can assist. Github is for more code related issues.

<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

ot this line in apache < 2.4

    <FilesMatch "\.php$">
        Order deny,allow
        Deny from all
    </FilesMatch>

wilsonfe · 2022-03-29T09:38:47Z

My installation is on hostinger on a shared hosting. They use Litespeed 5.4. Don't use apache.

If I uncomment it gives error 403.

<FilesMatch ".php$">
Require all denied

raramuridesign · 2022-03-29T14:58:04Z

@wilsonfe I think you might need to ask someone who has knowledge on lightspeed.
Please join the forum and post your question there.

DanVen73 · 2022-03-31T12:25:20Z

Hello there, I have an installation of mautic in a subdomain (sub.domain.com).
After upgrading to 4.2.0 and now to 4.2.1 I had to change .htaccess file because of HTTP ERROR 403.
Changed the following lines:

# Except those allowed below.
#<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#">
<FilesMatch "^(index|index_dev|filemanager|upgrade).php$">
    Require all granted
</FilesMatch>
#</If>

That's all. It worked.

Have a nice day.

marcoalejandropalacio · 2022-03-31T12:32:29Z

@DanVen73

Making this change... everything inside Mautic works fine for you?

There are no functions that do not work?

DanVen73 · 2022-03-31T12:45:14Z

I tried forms, landing, campaigns automation, multiple users connected, no problem.
@marcoalejandropalacio -> "There are no functions that do not work?" give me examples please. I'll check.

wilsonfe · 2022-03-31T13:45:57Z

DanVen73

The only way to install the new version was to install it all over again.

I tried to update version 4.2.0 to 4.2.1 and got the same problem (403).

I will have to redo the installation again from scratch.

I use a subdomain. email.domain.com.

I tried to do what @DanVen73 said, but I was unsuccessful.

wilsonfe · 2022-03-31T13:47:38Z

I updated the .htacess file before trying to do the update from the panel.

Except those allowed below.

#<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade).php#">
<FilesMatch "^(index|index_dev|filemanager|upgrade).php$">
Require all granted

#

I don't know if I did it right.

marcoalejandropalacio · 2022-03-31T13:52:43Z

@DanVen73

It happened to me that the segment options did not work for me and two more options that I do not remember now.

DanVen73 · 2022-03-31T14:03:40Z

@wilsonfe

You have to substitute this:
# Except those allowed below. <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#"> Require all granted </If>

With this
# Except those allowed below. #<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#"> <FilesMatch "^(index|index_dev|filemanager|upgrade).php$"> Require all granted </FilesMatch> #</If>

wilsonfe · 2022-03-31T14:08:29Z

@wilsonfe

You have to substitute this: # Except those allowed below. <If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#"> Require all granted </If>

With this # Except those allowed below. #<If "%{REQUEST_URI} =~ m#^/(index|index_dev|upgrade/upgrade)\.php#"> <FilesMatch "^(index|index_dev|filemanager|upgrade).php$"> Require all granted </FilesMatch> #</If>

Thanks

marcoalejandropalacio · 2022-04-01T02:14:58Z

How can I update mautic manually?

I realized that one of the errors that I am having is that when updating mautic from the notification, it keeps loading one of the steps continuously

mautibot · 2022-04-26T21:31:22Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/403-forbidden-after-fresh-install-with-softaculous/23891/11

mautibot · 2022-05-01T17:13:36Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/error-while-upgrading-from-3-3-4-to-4-0/20686/8

mautibot · 2022-05-28T16:16:24Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/as-usual-upgrade-to-4-2-2-this-time-effed-up-my-installation/24106/12

mautibot · 2022-05-30T08:36:23Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/mautic-upgrade-to-4-3-1-produces-403-http-error-unless-htaccess-security-lines-are-removed/24255/3

mautibot · 2022-06-14T16:50:30Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/security-enhancement-gives-403/24460/2

cherouvim · 2022-06-30T07:15:05Z

Is there a solution available which will survive potential mautic upgrades? Maybe something I can specify on my server's VirtualHost which can override the .php related deny?

raramuridesign · 2022-06-30T12:43:54Z

@cherouvim it does not look like hence why its been documented ;-)

mooror · 2022-06-30T23:08:55Z

Can someone check to see if @DanVen73's change works with an install that is not in a subdomain? Because his revisions to the .htaccess file solved our access issues when installing Mautic on a subdomain, and if it works for normal installs as well, then to my mind it should just be included in the core.

Also, has this been documented anywhere? It took us awhile to find this issue and fix the problem, but had it been mentioned in the install instructions (even as a side note) it would have been real quick and reduced frustrations

mautibot · 2022-07-02T15:06:05Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/which-htaccess-line-should-i-change-remove-to-make-upgrade-work-on-subdomain/24664/1

DELTASERVERS · 2022-07-21T22:02:21Z

Dear Ones,

It is simple to solve this problem, just remove everything from /.htaccess and apply the listed below:

Prezados,

É simples resolver esse problema, basta remover tudo do /.htaccess e aplicar o listado abaixo:

RewriteEngine On
DirectoryIndex index.php

# Protegendo seu arquivo .htaccess 
# Protecting your .htaccess file

<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>

# Mitigação temporária de força bruta
# Temporary Brute Force Mitigation

SetEnvIfNoCase User-Agent "python-requests" bad_user
Deny from env=bad_user

# Impedindo a listagem de qualquer arquivo e diretório
# Preventing the listing of any file and directory

Options -Indexes

# Remover diretorio .PHP
# Remove .PHP directory

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

<ifModule mod_headers.c>
header always set x-xss-protection "1; mode=block"
</ifModule>

<ifModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
</ifModule>

# Aplicar regras HSL
# Apply HSL rules

<ifModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
</ifModule>

# Força HTTPS
# Force HTTPS

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


<IfModule mod_expires.c>
  ExpiresActive On

 # Images
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"

  # Video
  ExpiresByType video/webm "access plus 1 year"
  ExpiresByType video/mp4 "access plus 1 year"
  ExpiresByType video/mpeg "access plus 1 year"

  # Fonts
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType font/otf "access plus 1 year"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType application/font-woff "access plus 1 year"

  # CSS, JavaScript
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType text/javascript "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"

  # Others
  ExpiresByType application/pdf "access plus 1 month"
  ExpiresByType image/vnd.microsoft.icon "access plus 1 year"
</IfModule>

mautibot · 2022-09-23T07:21:25Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/mautic-upgrade-to-4-3-1-produces-403-http-error-unless-htaccess-security-lines-are-removed/24255/11

mautibot · 2023-05-02T00:53:49Z

This issue has been mentioned on Mautic Community Forums. There might be relevant details there:

https://forum.mautic.org/t/mautic-installation-on-litespeed-server-through-softaculous/27864/2

mautibot · 2023-09-25T15:49:10Z

This issue has been mentioned on Mautic Forums. There might be relevant details there:

https://forum.mautic.org/t/installed-mautic-4-4-10-with-softaculous-getting-403-error/29425/2

mautibot · 2024-02-21T17:46:32Z

This issue has been mentioned on Mautic Forums. There might be relevant details there:

https://forum.mautic.org/t/i-have-some-issues-to-update-from-4-1-0/30477/7

mautibot · 2024-02-21T17:48:10Z

This issue has been mentioned on Mautic Forums. There might be relevant details there:

https://forum.mautic.org/t/can-i-install-mautic-5-and-after-using-the-database-of-the-4-1-0-version/30736/2

raramuridesign added bug Issues or PR's relating to bugs needs-triage For new issues/PRs that need to be triaged labels Mar 1, 2022

RCheesley added the configuration Anything related to the Mautic configuration section label Mar 1, 2022

RCheesley added wont-fix Issues which are closed as won't fix. and removed needs-triage For new issues/PRs that need to be triaged labels Mar 4, 2022

RCheesley closed this as completed Mar 4, 2022

RCheesley mentioned this issue Mar 4, 2022

Document setting for htaccess mautic/mautic-documentation#302

Open

[upgrade] 4.1.2 to 4.2.0 issue with .htaccess #10913

[upgrade] 4.1.2 to 4.2.0 issue with .htaccess #10913

Comments

raramuridesign commented Mar 1, 2022 • edited

Mautic Version

PHP version

What browsers are you seeing the problem on?

What happened?

How can we reproduce this issue?

Relevant log output

Code of Conduct

RCheesley commented Mar 1, 2022

RCheesley commented Mar 1, 2022

mautibot commented Mar 1, 2022

raramuridesign commented Mar 1, 2022

RCheesley commented Mar 1, 2022 • edited

raramuridesign commented Mar 1, 2022

mollux commented Mar 1, 2022

raramuridesign commented Mar 2, 2022 • edited

mollux commented Mar 2, 2022

raramuridesign commented Mar 2, 2022

RCheesley commented Mar 2, 2022

nikitakothari06 commented Mar 2, 2022

marcoalejandropalacio commented Mar 2, 2022

RCheesley commented Mar 2, 2022

marcoalejandropalacio commented Mar 2, 2022

RCheesley commented Mar 4, 2022

github-actions bot commented Mar 4, 2022

⚠️COMMENT VISIBILITY WARNING⚠️

nikitakothari06 commented Mar 10, 2022

wilsonfe commented Mar 28, 2022

wilsonfe commented Mar 28, 2022

raramuridesign commented Mar 29, 2022 • edited

wilsonfe commented Mar 29, 2022 • edited

raramuridesign commented Mar 29, 2022

wilsonfe commented Mar 29, 2022 • edited

raramuridesign commented Mar 29, 2022

DanVen73 commented Mar 31, 2022

marcoalejandropalacio commented Mar 31, 2022

DanVen73 commented Mar 31, 2022

wilsonfe commented Mar 31, 2022

wilsonfe commented Mar 31, 2022

Except those allowed below.

marcoalejandropalacio commented Mar 31, 2022

DanVen73 commented Mar 31, 2022

wilsonfe commented Mar 31, 2022

marcoalejandropalacio commented Apr 1, 2022 • edited

mautibot commented Apr 26, 2022

mautibot commented May 1, 2022

mautibot commented May 28, 2022

mautibot commented May 30, 2022

mautibot commented Jun 14, 2022

cherouvim commented Jun 30, 2022 • edited

raramuridesign commented Jun 30, 2022

mooror commented Jun 30, 2022

mautibot commented Jul 2, 2022

DELTASERVERS commented Jul 21, 2022

mautibot commented Sep 23, 2022

mautibot commented May 2, 2023

mautibot commented Sep 25, 2023

mautibot commented Feb 21, 2024

mautibot commented Feb 21, 2024

raramuridesign commented Mar 1, 2022 •

edited

RCheesley commented Mar 1, 2022 •

edited

raramuridesign commented Mar 2, 2022 •

edited

raramuridesign commented Mar 29, 2022 •

edited

wilsonfe commented Mar 29, 2022 •

edited

wilsonfe commented Mar 29, 2022 •

edited

marcoalejandropalacio commented Apr 1, 2022 •

edited

cherouvim commented Jun 30, 2022 •

edited