Htaccess blocca installazione wordpress

hikari

Htaccess blocca installazione wordpress

Salve a tutti,
ho un sito web online fatto (non da me) con Joomla. In una sottocartella "wp", via FTP, ho tentato di installare Wordpress ma quando procedo con l'installazione mi dà errore 403:
"You don't have permission to access /wp/wp-admin/install.php on this server".
Ho controllato i permessi via FTP, mi sembrano giusti (sono 0755 per la cartella wp e 0644 per i file). L'hosting, interpellato, mi dice che è un problema nel file .htaccess della root principale, dove è installato Joomla, ma non mi vuole aiutare oltre.
Il file htaccess l'ho guardato (600 righe...) ma non saprei cosa correggere... ci sono una serie di blocchi ma non so bene quale sia il problema. Qualcuno può aiutarmi? Grazie!

miwebdesign

Dovresti postare il codice del file .htaccess.. Così su due piedi nessuno potrà aiutarti dato che le cause potrebbero essere diverse.

hikari

Sì, in effetti... qui provo a postare solo il codice che provoca errore 403, 404 e che blocca l'accesso a htaccess e configuration.php
Poi se serve tutto il resto, metto anche quello.
Grazie!

########## Begin - Rewrite rules to block out some common exploits

If you experience problems on your site block out the operations listed below

This attempts to block the most common type of exploit `attempts` to Joomla!

If the request query string contains /proc/self/environ

RewriteCond %{QUERY_STRING} proc/self/environ

Block out any script trying to set a mosConfig value through the URL

(these attacks wouldn't work w/out Joomla! 1.5's Legacy Mode plugin)

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D)

Block out any script trying to base64_encode or base64_decode data within the URL

RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]([^)])

IMPORTANT: If the above line throws an HTTP 500 error, replace it with these 2 lines:

#RewriteCond %{QUERY_STRING} base64_encode(.)
%{QUERY_STRING} base64_decode(.)

Block out any script that includes a <script> tag in URL

RewriteCond %{QUERY_STRING} (<|%3C)([^s]s)+cript.(>|%3E) [NC,OR]

Block out any script trying to set a PHP GLOBALS variable via URL

RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2})

Block out any script trying to modify a _REQUEST variable via URL

RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})

Return 403 Forbidden header and show the content of the root homepage

RewriteRule .* index.php

########## End - Rewrite rules to block out some common exploits

#Block mySQL injects
RewriteCond %{QUERY_STRING} (;|<|>|’|”|)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC,OR]

RewriteCond %{QUERY_STRING} ../..

RewriteCond %{QUERY_STRING} (localhost|loopback|127.0.0.1) [NC,OR]
RewriteCond %{QUERY_STRING} .[a-z0-9] [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|’|%0A|%0D|%27|%3C|%3E|%00)

Note: The finalRewriteCond must NOT use the flag.

Return 403 Forbidden error.

RewriteRule .* index.php

########## Block bad user agents

RewriteCond %{HTTP_USER_AGENT} ^BlackWidow
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot @ yahoo. com
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw
RewriteCond %{HTTP_USER_AGENT} ^Custo
RewriteCond %{HTTP_USER_AGENT} ^DISCo
RewriteCond %{HTTP_USER_AGENT} ^Download\ Demon
RewriteCond %{HTTP_USER_AGENT} ^eCatch
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf
RewriteCond %{HTTP_USER_AGENT} ^Express\ WebPictures
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE
RewriteCond %{HTTP_USER_AGENT} ^FlashGet
RewriteCond %{HTTP_USER_AGENT} ^GetRight
RewriteCond %{HTTP_USER_AGENT} ^GetWeb!
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It
RewriteCond %{HTTP_USER_AGENT} ^GrabNet
RewriteCond %{HTTP_USER_AGENT} ^Grafula
RewriteCond %{HTTP_USER_AGENT} ^HMView
RewriteCond %{HTTP_USER_AGENT} HTTrack [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Stripper
RewriteCond %{HTTP_USER_AGENT} ^Image\ Sucker
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja
RewriteCond %{HTTP_USER_AGENT} ^JetCar
RewriteCond %{HTTP_USER_AGENT} ^JOC\ Web\ Spider
RewriteCond %{HTTP_USER_AGENT} ^larbin
RewriteCond %{HTTP_USER_AGENT} ^LeechFTP
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX
RewriteCond %{HTTP_USER_AGENT} ^Navroad
RewriteCond %{HTTP_USER_AGENT} ^NearSite
RewriteCond %{HTTP_USER_AGENT} ^NetAnts
RewriteCond %{HTTP_USER_AGENT} ^NetSpider
RewriteCond %{HTTP_USER_AGENT} ^Net\ Vampire
RewriteCond %{HTTP_USER_AGENT} ^NetZIP
RewriteCond %{HTTP_USER_AGENT} ^Octopus
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Explorer
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Navigator
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto
RewriteCond %{HTTP_USER_AGENT} ^pavuk
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser
RewriteCond %{HTTP_USER_AGENT} ^RealDownload
RewriteCond %{HTTP_USER_AGENT} ^ReGet
RewriteCond %{HTTP_USER_AGENT} ^SiteSnagger
RewriteCond %{HTTP_USER_AGENT} ^SmartDownload
RewriteCond %{HTTP_USER_AGENT} ^SuperBot
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP
RewriteCond %{HTTP_USER_AGENT} ^Surfbot
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut
RewriteCond %{HTTP_USER_AGENT} ^Teleport\ Pro
RewriteCond %{HTTP_USER_AGENT} ^VoidEYE
RewriteCond %{HTTP_USER_AGENT} ^Web\ Image\ Collector
RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker
RewriteCond %{HTTP_USER_AGENT} ^WebAuto
RewriteCond %{HTTP_USER_AGENT} ^WebCopier
RewriteCond %{HTTP_USER_AGENT} ^WebFetch
RewriteCond %{HTTP_USER_AGENT} ^WebGo\ IS
RewriteCond %{HTTP_USER_AGENT} ^WebLeacher
RewriteCond %{HTTP_USER_AGENT} ^WebReaper
RewriteCond %{HTTP_USER_AGENT} ^WebSauger
RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor
RewriteCond %{HTTP_USER_AGENT} ^Website\ Quester
RewriteCond %{HTTP_USER_AGENT} ^WebStripper
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker
RewriteCond %{HTTP_USER_AGENT} ^WebZIP
RewriteCond %{HTTP_USER_AGENT} ^Widow
RewriteCond %{HTTP_USER_AGENT} ^WWWOFFLE
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider
RewriteCond %{HTTP_USER_AGENT} ^Zeus

Note: The finalRewriteCond must NOT use the flag.

Return 403 Forbidden error.

RewriteRule .* -

Bloccare accesso diretto al core di Joomla!

Deny access to php, xml and ini files

within components and plugins directories

RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_URI} .php|.ini|.xml
RewriteCond %{REQUEST_URI} /components/
RewriteCond %{REQUEST_URI} ^/includes/|^/administrator/includes/
RewriteCond %{REQUEST_URI} /language/
RewriteCond %{REQUEST_URI} /libraries/
RewriteCond %{REQUEST_URI} /modules/
RewriteCond %{REQUEST_URI} /plugins/
RewriteCond %{REQUEST_URI} /templates/
RewriteCond %{REQUEST_URI} /xmlrpc/
RewriteRule ^(.*)$ index.php [R=404,L]

End - Bloccare accesso diretto al core di Joomla!

Bloccare accesso file .htaccess e configuration.php

<Files .htaccess>
order allow,deny
deny from all
</Files>

<Files configuration.php>
order allow,deny
deny from all
</Files>

End - Bloccare accesso file .htaccess e configuration.php

fda

Ciao hikari,
potrebbe dipendere dall'avere bloccato l'accesso diretto al file php:


RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_URI} \.php|\.ini|\.xml

... anche se dovrebbe dare un 404 e non un 403. Sono tutte qui le istruzioni htaccess?

hikari

Ciao FDA,
grazie mille, adesso provo e poi aggiorno. Di istruzione nel file htaccess ce ne sono 600 righe... intanto provo questa poi vediamo.
H.

miwebdesign

Secondo me sono tutte inutili queste regole .htaccess, 600 sono esagerate veramente.

Io avrei tolto tutto e me ne sarei fatto uno io e sarei arrivato al massimo a 50 righe.

hikari

...niente da fare. Ho provato a togliere dall' htaccess il codice indicatomi da FDA ma mi nega ancora il permesso di accedere al file install.php.
A questo punto, dovrei cambiare del tutto il file htaccess, come mi consiglia MiWebDesign e metterne uno semplificato.
Tenendo conto che:

Il sito è fatto (non da me...) in Joomla 1.5.26 (orrore orrore)
E' attiva la riscrittura delle url
L'aspetto sicurezza non mi interessa perché tra poco il sito sarà completamente cambiato
Sareste così gentili da indicarmi dove potrei trovare un testo per htaccess idoneo?
Grazie!

fda

Puoi fare test commentando gruppi di istruzioni oppure scaricare il file htaccess da un'installazione nuova (per Joomla guarda qui: joomla.it/download/joomla-15.html).

hikari

Grazie mille, finalmente ho risolto, installando il file htaccess originale di Joomla.
H.

Htaccess blocca installazione wordpress

If you experience problems on your site block out the operations listed below

This attempts to block the most common type of exploit attempts to Joomla!

If the request query string contains /proc/self/environ

Block out any script trying to set a mosConfig value through the URL

(these attacks wouldn't work w/out Joomla! 1.5's Legacy Mode plugin)

Block out any script trying to base64_encode or base64_decode data within the URL

IMPORTANT: If the above line throws an HTTP 500 error, replace it with these 2 lines:

Block out any script that includes a <script> tag in URL

Block out any script trying to set a PHP GLOBALS variable via URL

Block out any script trying to modify a _REQUEST variable via URL

Return 403 Forbidden header and show the content of the root homepage

Note: The finalRewriteCond must NOT use the flag.

Return 403 Forbidden error.

Note: The finalRewriteCond must NOT use the flag.

Return 403 Forbidden error.

Bloccare accesso diretto al core di Joomla!

Deny access to php, xml and ini files

within components and plugins directories

End - Bloccare accesso diretto al core di Joomla!

Bloccare accesso file .htaccess e configuration.php

End - Bloccare accesso file .htaccess e configuration.php

This attempts to block the most common type of exploit `attempts` to Joomla!