XF 2.3 403 Forbidden Error

[spk100]

For the last two months, a small percentage of my users are reporting a 403 forbidden error.

I am on Litespeed, running v2.3.3 with all add-ons updated.

I asked my host to check but they came back with a negative. Mod security is turned off.

The only thing I can found is the IP address of these users are blacklisted by spamhaus - those who emailed me, I checked their IP for blacklist.

Other than that, I do not know what else could be the reason.

Any pointers on where I should look to fix this would be helpful.

 

[TUG]

ever get anywhere with this? this describes the exact problem on my server thats manifested itself over the past few months.

completely random and sporadic, even ive seen it personally when logged in via admin but only once.

server support has spent weeks digging into modsec and firewall rules/logs and claim emphatically its not the cause and are pushing back on it being the application itself.

one user says they see this when browsing their phone via tapatalk

 

[MySiteGuy]

I bet they are Safari users. There's a known issue with the most recent Safari updates discussed in other threads, along with solutions.

 

[TUG]

nope, its across all platforms...even ive seen it (logged into admin) using chrome and firefox.

one user that sees it a ton more than the rest (or at least hes the most vocal about it happening) regularly gets it using tapatalk but also claims he sees it browsing regualrly as well.

 

[TUG]

have spent all week working with host to track this down, they are 100% sure this is not being triggered by any firewall or modsec rules on the server and are of the opinion the error is coming from the forum application itself.

while we do have some various ip bans in place within xenforo (for known spam/whatever ip blocks i china/etc)....if this were triggering it I have to assume the users would:

1. get a different message
2. get the message every time they accessed the site from that IP.

when in actuality, this message goes away after clicking refresh 2 or 3 times and does not come back during the entire session.

It even happened to me again earlier this week while I was logged into my admin account, from my whitelisted ip. clicking refresh instantly loaded the page without error.

while its a rare inconvenience for me, a number of my users report it happens to them far more frequently on an almost daily basis, though I cant find anything in any log anywhere.

 

[TUG]

latest response from the host is pushing this error back on xenforo?



We identified the root cause. The errors are originating from two specific library files in your forum installation that use a PHP syntax which was fully removed in PHP 8.0 and above:

• forums/library/Lgpl/utf8.php (line 47)
• forums/library/Zend/Registry.php (line 206)

These files use curly brace string offset syntax (e.g. $str{$i}) which is no longer supported in PHP 8.x. This would explain why the issue is relatively new — it is likely triggered by a recent PHP 8.2 minor version update on the server that enforces this more strictly.

We have two options to resolve this:

1. We can temporarily downgrade your domain to PHP 8.1, which would stop the fatal errors while your developer reviews the files.

2. Your developer can update those two library files by replacing the curly brace syntax with square brackets (e.g. $str[$i]), which is a straightforward fix.

Please let us know which option you would prefer and we will proceed accordingly.

 

[smallwheels]

The errors are originating from two specific library files in your forum installation that use a PHP syntax which was fully removed in PHP 8.0 and above

Which version of XF are you running? You did not mention that, did you? People have been running PHP8.x for ages w/o issues, even the latest versions and even the PHP-version recommended by XF is I think 8.2 or 8.3.

 

[TUG]

yes, we've been running 8 for some time now without issues...this has only come up in the past few months and i guess it coincides with their claimed micro-update to php?

im currently using php 8.2.31
xen 2.2.17 (sorry, i didnt realize this thread was a 2.3 one when I did the search to reply)

 

[smallwheels]

xen 2.2.17

Maybe a hint to think about upgrading - 2.3 came out already 2 years ago and 2.2.18 and 2.2.19 with security fixes this year. It probably won't get better regarding PHP and 2.2.

 

[beerForo]

@TUG who is your host? I can't get my host to investigate third-party issues, seems like they were pretty thorough, no matter the outcome.

 

[TUG]

Maybe a hint to think about upgrading - 2.3 came out already 2 years ago and 2.2.18 and 2.2.19 with security fixes this year. It probably won't get better regarding PHP and 2.2.

yeaaaa...its on the never ending todo list.

 

[TUG]

@TUG who is your host? I can't get my host to investigate third-party issues, seems like they were pretty thorough, no matter the outcome.

liquidweb ive been very happy with them for many years now.

 

[beerForo]

liquidweb ive been very happy with them for many years now.

LOL I'm on LW too so that's good to hear lol!

 

[TUG]

I have two dedicated/managed servers with them, perhaps its a different support level if you just have the barebones vps stuff?

 

[beerForo]

No real complaints about support it just seemed above and beyond but that's good to hear.

 

[beerForo]

Been with them since it was WiredTree and they took it over.

 

[TUG]

am a bit frustrated they dropped the phone support completely and went to all email/portal based...but other than that its been quite good.