Error Message when trying to send email to authors!!

[lorenzoat]

Hi all,

Since two days ago we are receiving the following error message: "You don't have permission to access /ojs/index.php/rlmm/user/email on this server." everytime we try to send an email to any authors/editors/members.

For example, if you click the "mail icon" above the Editor name or Corresponding Author name you are directed to a white page with the above message.

Can you help me figure out this problem???.

Best regards,

[asmecher]

Hi lorenzoat,

You probably have a firewall that is mistakenly triggering the denial message based on the page contents. I'd suggest trying to temporarily disable it in order to see if that's the problem or not; if that changes the behavior, you may need to fine-tune its ruleset.

Regards,
Alec Smecher
Public Knowledge Project Team

[lorenzoat]

Hi Alec,

We are using a shared service at webhostingpad.com.

I verify on my Cpanel account and I could not find any "firewall" setting.

If you are talking about the computer I am working with. I had tried 4 diff. computers and Firefox, IExplore and Chrome.

Any more suggestions?.

Thanks,

Regards,

[asmecher]

Hi lorenzoat,

The email send form contains the words "delete" and "from" in it, and we've had reports of at least one server-side firewall that intervenes in that situation because it suspects an SQL injection attack. The content on the page is totally innocent ("delete" is used in the button that deletes attachments from the message, and "from" is used to indicate the sending email address) but unfortunately the firewall overreacts. There's not much we can do from within OJS except e.g. to rename the delete button to something more obscure. We've only heard of this second-hand, however, so I don't have any specific recommendations beyond investigating whatever firewall software you have. It's probably something server-side. There are other threads about this on the forum, and those might have more specific information.

That's assuming my diagnosis is correct, but I think it's likely.

Regards,
Alec Smecher
Public Knowledge Project Team

[lorenzoat]

Hi Alec,

I called the "Support/Customer Center" of my webhosting provider.

At the end it was a new mod_security rule that was originating this weird behavior.

Now, our OJS installation is running smoothly as usually..

Thanks for your quick support and patience..

Best regards,

[wblandon]

Hi lorenzoat.

We disabled mod_security in Apache and the problem was resolved. what rules do you enable on mod_security for OJS work without disable this module? We have Fedora 16.

Thanks.

[lorenzoat]

Hi wblandon,

Actually, I don't know the answer to your question. The server admin just disable completely the mod_security.

Regards,