Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Everytime I try to access this url http://mysite.com/somefile.php?url=http://google.com

I get Forbidden error, how I can solve this issue using .htaccess file. I am on shared hosting so all I can do it edit the .htaccess file and nothing else. Please tell me solution that can be implemented using the .htaccess file.

share|improve this question
    
If I try to access mysite.com/somefile.php?url= , then it works fine, I cant add some url after = . –  Harbhag Jul 29 '11 at 7:49
    
Try encode the / by %2F –  LazyOne Jul 29 '11 at 7:53
    
it didn't work mysite.com%2Fsomefile.php?url=http://google.com –  Harbhag Jul 29 '11 at 8:01
    
Not that slash -- the others in query string: http:%2F%2Fgoogle.com .. although it should work without encoding anyway. –  LazyOne Jul 29 '11 at 8:49
    
the others were already encoded, The thing is I cannot use any url after the "=" –  Harbhag Jul 29 '11 at 9:05

1 Answer 1

up vote 1 down vote accepted

You're probably getting bitten by your hosting provider's mod_security rules; the pattern of your URL is a common one associated with attempting to exploit PHP file include vulnerabilities, which are (still, unfortunately) one of the most common and easy to exploit vulnerability classes.

You can talk to your provider, or fix your application.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.