.album.jpg images giving 403 error

SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-07-06 13:20

My album covers aren't showing up. I have a Drupal 7 test site below at http://tvw.1996.org.uk/ and then the gallery under the sub folder /gallery3/

So far I've found that its giving a 403 Forbidden error, which is why it isn't showing up
http://tvw.1996.org.uk/gallery3/var/thumbs/Courses/.album.jpg

I've tried removing the drupal .htaccess (see attached file) and it then works, however removing the first half doesn't work and removing the second part, keeping the first part doesn't work either. Seems to be related to the ".album.jpg" without a first part of the name.

Version: 3.0 RC2 (Santa Fe)
Operating system: Linux 2.6.18-164.el5
Apache: Apache/2.2.3 (CentOS 5)
PHP: 5.2.11
MySQL: 5.0.86
Link: http://tvw.1996.org.uk/gallery3

AttachmentSize
drupal.txt4.44 KB
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Tue, 2010-07-06 13:31

I am no rewrite expert as this is ...

Quote:
``Despite the tons of examples and docs, mod_rewrite is voodoo. Damned cool voodoo, but still voodoo.''

But I would look at this line:

<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$">
  Order allow,deny
</FilesMatch>

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-07-06 14:03

Removing those lines has no effect.

Added
<FilesMatch ".album.jpg">
Order deny,allow
</FilesMatch>

to my Gallery .htaccess file and it now works. I assume this won't have any security implications? Or any other issues with using Gallery3?

 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Tue, 2010-07-06 16:43

No. but don't now why you need to add that. You are the first to report this, so you must have some special configuration.

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-07-06 18:04

I've checked the gallery under a subdomain, and it works fine.
Seems to be something in Drupal 7 - Alpha 5

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Sat, 2010-10-09 15:40

If you look in the Drupal .htaccess about halfway down:

# Block access to "hidden" directories whose names begin with a period.
# NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is
# not possible to block access to entire directories from .htaccess, because
# <DirectoryMatch> is not allowed here.

RewriteRule "(^|/)\." - [F]

I had to disable the rule to get my Album thumbs unblocked.

 
nivekiam
nivekiam's picture

Joined: 2002-12-10
Posts: 16504
Posted: Sat, 2010-10-09 15:48

Ah so not only do some poor quality hosts just blindly block hidden files, but Drupal tries to "secure" your stuff for you too...

Thanks for the info, one more thing to check when this pops up.
____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Fri, 2010-10-22 03:45

I'll add a little more to my last post as it's bound to crop up more now that Drupal 7 is in Beta.

To get G3 album highlight thumbs to show, two modifications to the Drupal 7 .htaccess are now needed.

1.

Quote:
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*
|Entries.*|Repository|Root|Tag|Template)$">
Order allow,deny
</FilesMatch>

Change to:

Quote:
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\.
|Entries.*|Repository|Root|Tag|Template)$">
Order allow,deny
</FilesMatch>

So just remove .* from |^(\..*

2.

Access is blocked to "hidden" directories whose names begin with a period by default:

Quote:
RewriteRule "(^|/)\." - [F]

Block the rule:

Quote:
#RewriteRule "(^|/)\." - [F]

Only the second change was needed until the upgrade from RC to 3.0 final (which explains why others didn't have problems until upgrading, their servers don't have mod_rewrite enabled). I've tested a few times with fresh installs on hosted and local set-ups and both changes are definitely needed now (that is, if mod_rewrite is loaded, otherwise just the first change is needed).

Hope that helps out with future troubleshooting.

*edit - I found someone else with the same problem here:

http://gallery.menalto.com/node/98323

They're using Drupal and (looking at the posted link) haven't fixed it yet.
I've messaged him/her as it's probably the same issue.

 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 27300
Posted: Thu, 2010-10-21 02:39

I have created a ticket for this issue:
https://sourceforge.net/apps/trac/gallery/ticket/1443
I think we just need to rethink the highlight name. or perhaps make specific docs to reflect these findings.

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team

 
nivekiam
nivekiam's picture

Joined: 2002-12-10
Posts: 16504
Posted: Thu, 2010-10-21 18:04

While I like our implementation of how we deal with album thumbnail highlights. I wouldn't mind seeing the name change to ensure it works across the board. Perhaps something like album.highlight.jpg making it pretty obvious of what it is.

That would eliminate the need for docs and someone hitting a bump in the road for getting G3 running and thus hopefully even easier to use for more people.

____________________________________________
Like Gallery? Like the support? Donate now!!! See G2 live here

 
bharat
bharat's picture

Joined: 2002-05-21
Posts: 7994
Posted: Tue, 2010-10-26 03:51

Yeah the problem with picking a name is that there's the chance that whatever name we choose by default will conflict with a photo name. So if somebody uploads a photo named "album.highlight.jpg" it'd stomp the highlight. But file a ticket, I'll see what I can do.
---
Problems? Check gallery3/var/logs
bugs/feature req's | upgrade to the latest code | use git

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 06:41

Is it possible to reverse/override the root .htaccess rules?
I mean, if Drupal .htaccess blocks .album.jpg's, is there not something that could be added to G3 .htaccess to allow them?

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-10-26 07:53
SparkyMarky89 wrote:
Added
<FilesMatch ".album.jpg">
Order deny,allow
</FilesMatch>

to my Gallery .htaccess file and it now works. I assume this won't have any security implications? Or any other issues with using Gallery3?

Couldn't we include this in the Gallery .htaccess?

Also, do we need a specific highlight image? The database has the field `album_cover_item_id`, could we not use that to return the correct highlight image. Its a extra call to the database, but the album highlight image wouldn't need to be a seperate image.

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 13:37
SparkyMarky89 wrote:
Added
<FilesMatch ".album.jpg">
Order deny,allow
</FilesMatch>

to my Gallery .htaccess file and it now works. I assume this won't have any security implications? Or any other issues with using Gallery3?

Cheers, yeah, sorry, I did see your original post, but it went out of my mind as it didn't work for me because of the RewriteRule, adding that to G3 .htaccess does solve having to change the Drupal <Filesmatch... |^(\..*

The RewriteRule "(^|/)\." - [F] still needs to be sorted tho', I think a reverse rule of some kind will have to be added.

Doesn't look like you have mod_rewrite loaded, which is why the rule isn't affecting your highlights?

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-10-26 13:35

Mod_rewrite is loaded according to phpinfo() and am using the

Quote:
<IfModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine On
RewriteBase /gallery3
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?kohana_uri=$1 [QSA,PT,L]
RewriteRule ^$ index.php?kohana_uri=$1 [QSA,PT,L]
RewriteRule ^index.php/(.*) $1 [QSA,R,L]
</IfModule>

to get rid of the index.php (so url is http://example.com/gallery3/Courses/ABA)

I've attached both .htaccess documents, Currently Drupal 7 Beta 2 & Gallery Version: 3.0 (Santa Fe)

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 14:42

A strange one then - I've just tested both hosted and local with original .htaccess files.

Adding your:

<FilesMatch ".album.jpg">
Order deny,allow
</FilesMatch>

to the G3 .htaccess's means I don't have to modify Drupals <FilesMatch any more.

But highlights are still blocked until I disable RewriteRule "(^|/)\." - [F]

I can see that you have the rule enabled in your D7 .htaccess, and your highlights are showing, so still not convinced that the rule is being read by your server.
Would be good if someone else could install Drupal 7 and G3 to test.

Here's the whole of the RewriteRule info for anyone else who's interested:

# Block access to "hidden" directories whose names begin with a period. This
# includes directories used by version control systems such as Subversion or
# Git to store control files. Files whose names begin with a period, as well
# as the control files used by CVS, are protected by the FilesMatch directive
# above.
#
# NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is
# not possible to block access to entire directories from .htaccess, because
# <DirectoryMatch> is not allowed here.
#
# If you do not have mod_rewrite installed, you should remove these
# directories from your webroot or otherwise protect them from being
# downloaded.
#RewriteRule "(^|/)\." - [F]

Local test site: http://audiognome.co.uk

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-10-26 14:34

Just tested, and RewriteRule "(^|/)\." - [F] only affects folders with a '.' at the start, as the comment above it in the .htaccess file for Drupal says :

Quote:
# Block access to "hidden" directories whose names begin with a period. This
# includes directories used by version control systems such as Subversion or
# Git to store control files. Files whose names begin with a period, as well
# as the control files used by CVS, are protected by the FilesMatch directive
# above.

If I comment it out I can get to a folder '.test' but with it still in then I get a forbidden message

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 14:55

Hmm - so I wonder why the rule is blocking my highlights on two different Apache servers, one hosted in Chicago and my local one, here in the UK.
Many fresh installs on both.

With RC1 - I didn't even have to change <FilesMatch

Only had to # the RewriteRule to get highlights to show.

aargh! heh

Here's G3 with the Drupal 7 RewriteRule enabled:

http://audiognome.co.uk/gallery3/

 
SparkyMarky89

Joined: 2010-07-06
Posts: 7
Posted: Tue, 2010-10-26 15:12

Could it be a difference in server specifications?
Mine are below:

# Operating system: Linux 2.6.18-194.11.4.el5
# Apache: Apache/2.2.3 (CentOS 5)
# PHP: 5.2.13
# MySQL: 5.0.86

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 17:14

You really couldn't get much difference between my test sites!

Host:

# Operating system: Linux 2.6.18-194.17.1.el5
# Apache: Apache/2.2.16 (Unix)
# PHP: 5.2.10
# MySQL: 5.0.84

Local:

# Operating system: Windows NT 6.1 build 7601 (Win 7 64 sp1)
# Apache: Apache/2.2.17 (Win32)
# PHP: 5.2.13
# MySQL: 5.0.51a (ooh, looks like I need to upgrade that! heh)

The rule appears to be treating the .album of .album.jpg as a directory and blocking it? Just don't know why it's doing that on my two servers and yours is ok.

Ahh well - at least we can both get out highlights showing, and know that your <FilesMatch needs to be added for sure. I'll have a look around over the next few days to see if I can find something that I can add to G3 .htaccess that works for me and that pesky rule.

 
zounds

Joined: 2008-06-23
Posts: 9
Posted: Tue, 2010-10-26 19:58
SparkyMarky89 wrote:
<IfModule mod_rewrite.c>
Options +FollowSymLinks
RewriteEngine On
RewriteBase /gallery3
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?kohana_uri=$1 [QSA,PT,L]
RewriteRule ^$ index.php?kohana_uri=$1 [QSA,PT,L]
RewriteRule ^index.php/(.*) $1 [QSA,R,L]
</IfModule>

I should have taken more notice of your post earlier, thanks, problem solved.

So you HAVE to use <IfModule> ... </IfModule>

and add your:

<FilesMatch ".album.jpg">
Order deny,allow
</FilesMatch>

= Drupal 7 and Gallery 3.0 working fine.

I've added this solution to the ticket here:

https://sourceforge.net/apps/trac/gallery/ticket/1443