Admin Error: 403 Forbidden

[jmokie]

Had to upload the files to my host after extracting on my machine.

Got the code uploaded and installed
Got an "installation complete" message
Finally I get to the login, and at last to the HOME page.

When I click on Administration -- I get:
 Error: 403 Forbidden   
 
SECURITY WARNING: Your referer does not match the root url.

I need interpretation?Huh

Manage portlets and edit content appear to work.

[Kevin]

Someone else reported that bug also. It seems to exist only for some user, I currently don't know why. Probably a browser/privacy setting.

I will turn theis check of by default for 2.7.1.

Till then you could edit the file "system/command/admin.cmd.php" and remove the check - somewhere around line ~545

[jmokie]

Thanks Kevin
I commented out n 545 to ln 559 and everything seemed to work alright.  now need to explore and learn the system
Jerry

[Kevin]

I am glad you finally made it - sorry for the bugs, will be fixed with 2.7.1!
Have fun

[fathex]

This function seems to cause problems when bigace is installed in a subdirectory, e.g. yourdomain.com/cms/
I faced the same problem. RewriteBase is set to cms/ and BIGACE_ROOT_DIR ist also set to cms/
Perhaps it has something to do with this configuration...

[fathex]

Ok. I have a solution, but I do not know if it breaks csrf attack protection.
The referer $_SERVER['HTTP_REFERER'] normally has the following form: httƿ://www_•example_•com/subdirectory/
and the variable $_SERVER['SERVER_NAME'] has the corresponding value www_•example_•com
However under the circumstances I mentioned in my last post (even if I do not know which setting exactly is responsable for this misbehaviour) the variable $_SERVER['SERVER_NAME'] has the value example_•com and therefore causes a mismatch

I replaced lines 553 and 554

Code:

        if($checkCsrf || (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'http://' . $_SERVER['SERVER_NAME']) !== 0 
        && strpos($_SERVER['HTTP_REFERER'], 'https://' . $_SERVER['SERVER_NAME']) !== 0)) {

with the following lines

Code:

        if($checkCsrf || (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'http://' . $_SERVER['SERVER_NAME']) !== 0 
&& strpos($_SERVER['HTTP_REFERER'], 'http://www.' . $_SERVER['SERVER_NAME']) !== 0
&& strpos($_SERVER['HTTP_REFERER'], 'https://www.' . $_SERVER['SERVER_NAME']) !== 0
        && strpos($_SERVER['HTTP_REFERER'], 'https://' . $_SERVER['SERVER_NAME']) !== 0)) {