install.php Functionality Blocked by Webhost

[meepmeep]

So I was trying to install GS on my webhost and I kept getting 403 errors. I opened a ticket with my webhost and they said that install.php was trying to call '/'.

At first, blocking '/' seemed pretty crazy. But they explained that the security restriction was aimed at blocking attacks against *NIX systems to the root file system (i.e. root file system that contains /etc, /sbin, etc.)

They weren't sure about the line number in install.php that was throwing the error but based on the logs, they determined this was the issue.

Is install.php necessary for proper installation? I see it does some preliminary checks and redirects to setup.php but I'm not sure whether it does anything vital to for the health of a GS system.

(If it doesn't do anything critical, I may just go to setup.php and just install GS.)

If it is necessary, is there a way to reformat the request (e.g. caling the full URL instead of '/') so my webhost doesn't throw a hissy fit?

Thank you all.

[shawn_a]

Without posting any actual information, we cannot really help you, as "trying to call /" does not mean much.

[meepmeep]

Without posting any actual information, we cannot really help you, as "trying to call /" does not mean much.

I agree with you but I can only give you what they tell me. Short of commenting out lines until I get to where their security system kicks in, I can't give you much more than the responses in their ticket.

Is install.php necessary or can I just skip to setup.php to install GS?

[shawn_a]

Turn debug mode on and post the errors.
Check error.txt

[meepmeep]

Turn debug mode on and post the errors.
Check error.txt

I copied temp.gsconfig.php to gsconfig.php and turned on debugging.

I tried again and there no file called error.txt.

[shawn_a]

so, what exactly happens when you visit install.php ?
No php errors ?

Does your host have a php error log ?

[meepmeep]

so, what exactly happens when you visit install.php ?
No php errors ?

Does your host have a php error log ?

No, there's no PHP error. It's a 403 error and according to the ticket, it's something handled by the web server:

I am unsure which line is causing the issue. You are correct that the web server (LiteSpeed) believes that the script is trying to list the full directory in a Linux environment. Here is the specific error:

[ACL] Access to context [/] is denied!

I'll ask whether there's a PHP error log but I don't think this is a PHP error.

[shawn_a]

It's an apache log, it should show something , it might be a mod sec filter or something.
apache error log or some rule # would help. Otherwise your host sounds mental.

[shawn_a]

I would love to work around your problem if we can but I need more info.
On the mean time ill post a installed site so you can copy it up.

[hameau]

... the web server (LiteSpeed) ...

I'm all for using minority solutions where they're a good fit, but a proprietary webserver, together with its own implementation of PHP (from what I can gather from their website), is surely asking for trouble.

Is there any reason for not using something more mainstream? Is there some anticipated return on the time investment necessary to get it working?

Just curious.

[shawn_a]

Did you try installing in a subdirectory ?

It might be an htaccess rule or the redirect conflict.

I missed that quote it could be a litespeed problem. Litespeed is pretty common though.

[hameau]

Litespeed is pretty common though.

Really? Are you thinking of lighttpd?

[shawn_a]

I probably am