通过Dropzone.js上传return '403 forbidden'而其他上传则没有'


Uploads through Dropzone.js return '403 forbidden' while other uploads don't

我使用TinyMCE与文件管理器响应文件管理器,其中包括DropZone.js。所有通过它上传文件的尝试都失败,并返回403 Forbidden错误消息。

我已经尝试将url参数更改为例如"index.php""/ui/scripts/libs/filemanager/upload_notexists.php"。"index.php"和原始url值是可访问的,没有错误消息,如果我在地址栏中键入它们。"noexistists"url返回404错误,因为它不存在。上传总是返回403 Forbidden,无论url。

我已经尝试设置forceFallback: truemethod: "post"/method: "put"。它仍然返回403 Forbidden.

这是初始化DropZone.js的代码:

var allowed_ext = new Array('jpg','jpeg','png','gif','bmp','tiff','svg','doc','docx','rtf','pdf','xls','xlsx','txt','csv','html','xhtml','psd','sql','log','fla','xml','ade','adp','mdb','accdb','ppt','pptx','odt','ots','ott','odb','odg','otp','otg','odf','ods','odp','css','ai','zip','rar','gz','tar','iso','dmg','mov','mpeg','mp4','avi','mpg','wma','flv','webm','mp3','m4a','ac3','aiff','mid','ogg','wav');
//dropzone config
Dropzone.options.myAwesomeDropzone = {
    dictInvalidFileType: "Filtypen är ej tillåten.",
    dictFileTooBig: "Den uppladdade filen överskrider max storleken.",
    dictResponseError: "SERVER ERROR",
    paramName: "file", // The name that will be used to transfer the file
    maxFilesize: 100, // MB
    url: "http://subdomain.example.com/ui/scripts/libs/filemanager/upload.php",
    //url: "http://subdomain.example.com/index.php",
    accept: function(file, done) {
        var extension=file.name.split('.').pop();
        extension=extension.toLowerCase();
        if ($.inArray(extension, allowed_ext) > -1) {
            done();
        }
        else { 
            done("Filtypen är ej tillåten."); 
        }
    },
    //forceFallback: true,
    //method: "post"
};

我试过用小<1 KB的图片以及多个更大的。

我也用下面的基本代码测试了上传,它可以工作:

<form method="post" enctype="multipart/form-data">
    Fil: <input type="file" name="filer[]" multiple>
    <br>
    <input type="submit">
</form>

下面是phpinfo()的核心部分:

CorePHP Version     5.3.28 
Directive   Local Value Master Value
allow_call_time_pass_reference  On  On
allow_url_fopen On  On
allow_url_include   Off Off
always_populate_raw_post_data   Off Off
arg_separator.input &   &
arg_separator.output    &   &
asp_tags    Off Off
auto_append_file    no value    no value
auto_globals_jit    On  On
auto_prepend_file   no value    no value
browscap    no value    no value
default_charset no value    no value
default_mimetype    text/html   text/html
define_syslog_variables Off Off
disable_classes no value    no value
disable_functions   link,symlink,exec,shell_exec,system,passthru    link,symlink,exec,shell_exec,system,passthru
display_errors  Off Off
display_startup_errors  Off Off
doc_root    no value    no value
docref_ext  no value    no value
docref_root no value    no value
enable_dl   Off Off
error_append_string no value    no value
error_log   /dev/null   /dev/null
error_prepend_string    no value    no value
error_reporting 30711   30711
exit_on_timeout Off Off
expose_php  Off Off
extension_dir   /usr/local/php53/lib/php/extensions/no-debug-non-zts-20090626   /usr/local/php53/lib/php/extensions/no-debug-non-zts-20090626
file_uploads    On  On
highlight.bg    #FFFFFF #FFFFFF
highlight.comment   #FF8000 #FF8000
highlight.default   #0000BB #0000BB
highlight.html  #000000 #000000
highlight.keyword   #007700 #007700
highlight.string    #DD0000 #DD0000
html_errors On  On
ignore_repeated_errors  Off Off
ignore_repeated_source  Off Off
ignore_user_abort   Off Off
implicit_flush  Off Off
include_path    .:/usr/local/lib/php    .:/usr/local/lib/php
log_errors  Off Off
log_errors_max_len  1024    1024
magic_quotes_gpc    Off Off
magic_quotes_runtime    Off Off
magic_quotes_sybase Off Off
mail.add_x_header   Off Off
mail.force_extra_parameters no value    no value
mail.log    no value    no value
max_execution_time  500 500
max_file_uploads    2000    2000
max_input_nesting_level 64  64
max_input_time  -1  -1
max_input_vars  8000    8000
memory_limit    512M    512M
open_basedir    no value    no value
output_buffering    1   1
output_handler  no value    no value
post_max_size   1600M   1600M
precision   12  12
realpath_cache_size 16K 16K
realpath_cache_ttl  120 120
register_argc_argv  On  On
register_globals    Off Off
register_long_arrays    On  On
report_memleaks On  On
report_zend_debug   On  On
request_order   no value    no value
safe_mode   Off Off
safe_mode_exec_dir  no value    no value
safe_mode_gid   Off Off
safe_mode_include_dir   no value    no value
sendmail_from   no value    no value
sendmail_path   /usr/sbin/sendmail -t -i    /usr/sbin/sendmail -t -i
serialize_precision 100 100
short_open_tag  On  On
SMTP    localhost   localhost
smtp_port   25  25
sql.safe_mode   Off Off
track_errors    Off Off
unserialize_callback_func   no value    no value
upload_max_filesize 800M    800M
upload_tmp_dir  no value    no value
user_dir    no value    no value
user_ini.cache_ttl  300 300
user_ini.filename   .user.ini   .user.ini
variables_order EGPCS   EGPCS
xmlrpc_error_number 0   0
xmlrpc_errors   Off Off
y2k_compliance  On  On
zend.enable_gc  On  On
编辑:我已经成功地在我的共享主机上打开了错误记录。它什么也没显示。:c (2014-07-15 18:48)

假设你的文件没有上传,你的URL是正确的,似乎这个问题是链接到响应文件管理器文件权限(403:Forbidden)。

检查父目录中这些文件和。htaccess的所有者

似乎我的共享主机为每个POST数据字符串抛出403 Forbidden,其中包括"/../"。作为安全特性…

当响应式文件管理器将上传数据发送到upload.php时,它也发送了一个配置变量,在我的情况下是"../../files",因为服务器向我抛出了403。

这个SO的答案让我相信这可能是由mod_security引起的,一个apache/主机环境的防火墙。我已经联系了我的共享主机,当他们回复时,我会更新答案。