up vote -1 down vote favorite
share [g+] share [fb]

Everytime I try to access this url http://mysite.com/somefile.php?url=http://google.com

I get Forbidden error, how I can solve this issue using .htaccess file. I am on shared hosting so all I can do it edit the .htaccess file and nothing else. Please tell me solution that can be implemented using the .htaccess file.

link|improve this question
100% accept rate
If I try to access mysite.com/somefile.php?url= , then it works fine, I cant add some url after = . – Harbhag Jul 29 '11 at 7:49
Try encode the / by %2F – LazyOne Jul 29 '11 at 7:53
it didn't work mysite.com%2Fsomefile.php?url=http://google.com – Harbhag Jul 29 '11 at 8:01
Not that slash -- the others in query string: http:%2F%2Fgoogle.com .. although it should work without encoding anyway. – LazyOne Jul 29 '11 at 8:49
the others were already encoded, The thing is I cannot use any url after the "=" – Harbhag Jul 29 '11 at 9:05
show 3 more comments
feedback

1 Answer

up vote 1 down vote accepted

You're probably getting bitten by your hosting provider's mod_security rules; the pattern of your URL is a common one associated with attempting to exploit PHP file include vulnerabilities, which are (still, unfortunately) one of the most common and easy to exploit vulnerability classes.

You can talk to your provider, or fix your application.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.