Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an html form like so:

form accept-charset="utf-8" enctype="multipart/form-data" name="edit_orders" action="custom-quotes-request.php?action=edit&id=<?php echo $_GET['id']; ?>&type=update" method="post"

There's two form fields which send customer email address. Part of the POST data is encoded as:

c_email=&email_cus=

Those two are just plain text fields. Whenever the email contains the string "rolex" I get a 403 Forbidden error. I've set file permissions and checked server configuration. I'm using a dedicated server and the support crew are quite knowledgeable on server management so I don't think there's some overlooking on their part (I think they just use a preconfigured server with CPanel).

The page does accept a GET request and returns output as appropriate. The problem only happens if the any of the email fields contain the "rolex" string and the request is POST.

So those work (the @ is urlencoded):

c_email=olex@gmail.com&email_cus=olex@gmail.com
c_email=role@gmail.com&email_cus=role@gmail.com

Those don't:

c_email=rolex@gmail.com&email_cus=rolex@gmail.com
c_email=arolex@gmail.com&email_cus=arolex@gmail.com

I've tried both form enctypes. I've also checked the error logs. I couldn't find any info at all on why this error occurs.

share|improve this question
    
Unrelated to the problem you are asking about, I noticed that your form is vulnerable to XSS. This bit in particular: <?php echo $_GET['id']; ?> is not validated or escaped. It looks very much like that value will be used in an SQL query later on and I suspect that will be vulnerable to SQL injection. –  Ladadadada Jan 23 '13 at 23:59
    
I know all this code is crappy. I didn't write this form. In fact i'm using a custom request builder to submit the test requests (also tried with the form). I can send you the whole source code of the request if needed. My confusion is why the particular request results in 403 specifically. Anyways thanks for your notes and for correcting the formatting of my question :) –  CodeFan Jan 24 '13 at 0:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.