Custom PHP error pages messing up htaccess

What is the correct code for those error pages?

[grandma genie]

Hello,
I've been discussing htaccess over in the Apache forum, but it appears my htaccess file is not working properly because of some php custom error pages.

I have an oscommerce website using php files. The index.php file is in the public folder, but it only points to a different index.php file in a different directory. So, there is a header( 'Location code in that first index.php file and also in both the 403.php and 404.php error files in the same directory.

My htaccess file is supposed to be causing 403 error messages for my allow/deny directives and my block certain referrers and certain user agents directives, but instead it is causing 301 redirects back to the home page or 500s.

I don't think there is a problem having the index.php in the public folder pointing to the other one. But I don't understand why the error pages are doing the same thing. I can't remove those error pages without causing my site to stop working and giving a can't find errordocument message. This is in the htaccess file:

Options All -Indexes
ErrorDocument 403 /403.php
ErrorDocument 404 /404.php

I don't think I can remove them, but what can I put in them that won't cause my htaccess to make my directives give the wrong messages.

I tried creating two different htaccess files. One in the root with the blocking directives and the other one in the public folder with just the ErrorDocument message, some redirects from my old site to my new one (just moved this month) and another directive that I believe is supposed to fix those unreadable URLs to readable ones.

So, now I am getting some 403s, but only when the unwanted visitor goes to the home directory. If they come in from old URLs, then they either get the 301 redirect or a 500.

What should those custom error pages have in them? At the moment they have the header( 'Location code, which I believe is a redirect to the home page. I just want the normal server error responses, not the redirects.

I hope this makes sense. Thank you for any suggestions.

[enigma1]

I am not sure I follow very well. If you have
header("Location: http://example.com");
will force a redirect. So you're saying you have this in the index.php and in the custom error handlers. This should do redirects for anyone who tries to access the home page or access an non-existing file or restricted area.

You also have another .htaccess in the root of your webpath. Is there the document root or is the one where the index.php is located?

Since you're using osC you could handle redirects or other errors from within the 404, 403 etc handlers in php and do all processing for referrers or whatever else in there and you can use the common platform functions. Far simpler than hard-coded redirects in htaccess (unless you have just a handful).

[grandma genie]

My host says they have mod security on their server, which might be messing up my htaccess file. I think that is the culprit. So, what do you say about disabling mod security?

[enigma1]

Perhaps some rule messes with this but it's uncertain. If you have control of the configuration files you can test it by disabling it then check the redirects and error pages.

I don't use it as I try to maximize server performance, but I wouldn't recommend to disable it permanently unless you know the server config and web scripts are patched and there are no vulnerabilities.

[g1smd]

Your error pages should not have headers which redirect within them.

That's a configuration error.

You should "include" the file you want to show, not redirect to a different URL.

[grandma genie]

That is correct. That is why I want to remove them. But when I do, the whole site gives this error message:
Not Found
The requested URL /store. was not found on this server.
Additionally, a 404 Not Found error was encountered while trying to
use an ErrorDocument to handle the request.

I can remove the 403.php with no problems. When I do, my allow/deny directives in htaccess work correctly.

But there is still a problem with that darn 404.php page. Somehow it is connected with the index.php file.

This is what is in the index.php file:

<?php
header( 'Location: [mywebsite.com...] ) ;
?>

I am assuming that is causing the server to give a 404 error message, which sends it to the 404.php file, which then sends it to the index.php file in the store directory. So the site works. But if I remove the 404.php error document, the site sends the Not Found error message.

My suspicion is the index.php code is incorrect. Can anyone tell what is wrong with it?

Grandma

[enigma1]

You should verify if the Allowoverride is enabled so the .htaccess is processed and the error handlers are invoked.

Now with apache by default when the 404 handler is invoked and unless specified otherwise the response header code will be 404. So if you wanted to redirect with the proper header you need to specify the redirect header (301 or 302 etc). The location header won't patch the response code just like that.

[grandma genie]

OK you guys. You can all beat me up. It was all my fault. What a dummy I am. I checked the site from my little laptop pc and there was no dot error. So I checked my Safari browser settings on my Mac and found the default opening page was set to www.mywebsite.com/store. I just changed it and everything is fine. What a dummy! I took the redirect out of htaccess and the site still works just fine. I can't stand it. I am just too dumb.

[lucy24]

Been there. Done that. Isn't there a thread in Foo called something like "Dumbest Mistake I Have Ever Made"?

Well, maybe I'm thinking of some other forum. But there should be.