XF 2.2 Has anyone ever had an issue with random images refusing to upload?

[PumpinIron]

This is the most bizarre thing, so forgive me if I've posted this in the wrong forum. I simply don't know if it's a XenForo bug, a server issue, or something else.

Every so often (and this seems very seldom unless members are underreporting it) someone will use the "Attach file" button and upload an image, pick their image, and watch it upload. Problem is, they encounter this:



Notice how the image is uploaded but there is no image at all? If you post the reply it creates a reply with no image at all in it.

When viewing my JavaScript debugging console, I see this error which I assume is related:



And here's the question: Why is this only happening on some image uploads?

 

[Paul B]

A 403 is a server forbidden error.

Contact your host.

 

[PumpinIron]

Thanks! I'll see what my host says.

 

[PumpinIron]

My host tells me they can’t find a single thing in the error logs.

Upon further investigation I found that when I remove the EXIF data from that image then it allows me to upload it just fine.

So what gives, why do some images need the EXIF data to be removed in order to be uploaded successfully?

Better yet, why is there nothing about this in the server error lots?

@Brogan, maybe you could move this to the server configuration and hosting forum?

 

[Paul B]

Is mod_sec or another security mechanism in place?

If so, it will be that.

 

[PumpinIron]

Is mod_sec or another security mechanism in place?

If so, it will be that.

Let me find out. Does mod_sec need to be disabled entirely?

 

[Paul B]

Your host should be able to whitelist whatever is triggering it (it's a false positive).

 

[PumpinIron]

Your host should be able to whitelist whatever is triggering it (it's a false positive).

I need to find a new system admin. The one I am dealing with now is useless. I’ll open a new ticket and get someone who knows what they’re doing. Thanks for your help!

 

[PumpinIron]

For anyone who is following along, my host is telling me that they can’t find anything whatsoever in the error logs pertaining to this.

Their solution is to remove the EXIF data which isn’t possible with XenForo and would instead require users to remove it on their end before uploading.

So it appears as if I’m stuck yet again.

 

[duderuud]

That solution is not a solution but a workaround.

Find another host.

 

[PumpinIron]

That solution is not a solution but a workaround.

Find another host.

I agree, it's a band-aid at best, not a solution.

 

[beerForo]

As B-man states, most likely ModSecurity. Generate the error and take note of the time, start a ticket and ask them to look for a ModSecurity error at that time and to whitelist the rule.

 

[PumpinIron]

As B-man states, most likely ModSecurity. Generate the error and take note of the time, start a ticket and ask them to look for a ModSecurity error at that time and to whitelist the rule.

I thought it might be ModSec as well. However, I disabled it and the issue still persists.

I'm wondering if it's related to Cloudflare.

 

[Paul B]

Anything which sits on the server and intercepts transactions could be involved - modsec, cloudflare, firewall, etc.

 

[PumpinIron]

Anything which sits on the server and intercepts transactions could be involved - modsec, cloudflare, firewall, etc.

Yep. I think I've ruled out mod_sec though since I disabled it entirely and the problem persists.

I have TWO forums on the same sever, both running the same XF version and everything. You can upload it to one of them just fine, but the other one gives these errors.

The only difference I can find between the two (being they are on the same server) is that the forum giving the errors is using Cloudflare whereas the other one is not.

My host is dumbfounded and stumped (saying they can't find anything whatsoever in the error logs). I've got a ticket open with Cloudflare so I'll wait to see what they say, but so far those guys are terrible in the support department.

 

[PumpinIron]

The best part about all this is that both my host and Cloudflare keep pointing the finger at each other.

Here's Cloudflare's response:




Hi,

Thank you for contacting Cloudflare Support. We're sorry to hear that you are experiencing a 403 error and we would be happy to assist!

If you're seeing a 403 error without Cloudflare branding, this is always returned directly from the origin web server, not Cloudflare, and is generally related to permission rules on your server.

The top reasons for this error are:

1. Permission rules you have set or an error in the .htaccess rules you have set
2. Mod_security rules.
3. IP Deny rules

Since Cloudflare can not access your server directly, please contact your hosting provider for assistance with resolving 403 errors and fixing rules. You should make sure that Cloudflare's IPs aren't being blocked.

There are some instances where Cloudflare will serve a branded 403 error page. Please review the below knowledge base article and community tip on resolving 403 Errors:

4xx Client Error

Community Tips- Fixing Error 403 Forbidden

Please let us know if you have any further questions!

 

[Max Taxable]

Did you try turning off CF to see if this problem vanishes?

 

[PumpinIron]

Did you try turning off CF to see if this problem vanishes?

Yep, I just confirmed that when you disable Cloudflare things work just fine. So it IS a Cloudflare issue.

Of course their support is so useless that they are insisting it’s a host issue, which it is not.

Now I need to figure out what setting in Cloudflare is causing this.

 

[Max Taxable]

Of course their support is so useless that they are insisting it’s a host issue, which it is not.

Doesn't seem logical for them to ignore your absolute proof.

 

[PumpinIron]

Doesn't seem logical for them to ignore your absolute proof.

You’re telling me. Their support so far is terrible. I’m awaiting their next response, we will see what they say. In the meantime I’ll go through all their settings one-by-one and disable them to see if it’s a setting perhaps.