I am getting a 403 error whenever I try to update the plugin options on the Options > Plugin page (i.e. zp-core/admin-options.php?page=options&tab=plugin). I am able to update options in other pages and tabs without any problem. It's just in this one page where I'm getting the 403 error.

Does anybody know what's causing this? I've tried changing the permissions of the zp-core and zp-data folders but to no avail.

Any help or insight on this problem will be greatly appreciated.

Thanks.

As always: What do the ZP debug log and the server error log tell?

There were a bunch of entries there so I reset the log in order to get a clean slate. I can then see the specific errors that get logged when I do the update. However, when I went to recreate the error, the error did happen but there was nothing in the log. just a trash can labeled "Delete". So I clicked on it and it ended up deleting the "Debug" tab. Not what I was expecting it to do. I thought I was just clearing out the trash bin.

How do I get the Debug tab back in the Logs page? And more importantly, why wasn't the 403 Error logged in the debug log?

BTW, acrylian, thanks for replying back so quickly. :o)

The server log doesn't provide much info. Just the following:

"GET /gallery/zp-core/zp-extensions/zpCaptcha/c.php?i=f8d09c4b02 HTTP/1.1" 200 … zp-core/admin-options.php?page=options&tab=plugin...

"POST /gallery/zp-core/admin-options.php?action=saveoptions HTTP/1.1" 403 ...zp-core/admin-options.php?page=options&tab=plugin...

That is the access log, we need the debug log. The one from ZP and the server one.

If you are referring to the log that's displayed in the Logs > Debug tab, there is nothing there. The log is empty. Only the Security and the Setup tabs have any entry in there.

I'm not sure what you mean by the server log. Where would I find that? I am running zenphoto on a hosted site so I don't have free access to system files on the host server.

I have a copy of zenphoto running on my computer which I use for testing but I'm not having this issue on my computer, just on the hosted site.

"403" is an access denied error. So probably there is a file permissions issue, possibly with the plugin you are trying to set options on.

@sbillard: That's what I was thinking and I've checked just about all the files and folders and they are all set to chmod 755. If I knew which file was causing the issue, I can check that file specifically.

It looks like I'm getting this error only when I try to update the Options > Plugin page or edit any file of a duplicated theme in Themes page. What do these two pages have in common that could be causing the 403 error?

The plugins list needs to access the plugin files to load them when enabled.

In any case you should find the server error log for any future problems. Only your host can tell you were that is.

This is what's in the Error log for the hosting server:

[Sat Nov 09 13:01:08 2013] [error] [client 64.121.73.199] ModSecurity: Access denied with code 403 (phase 2). Operator GT matched 255 at ARGS. [file "/hsphere/local/config/httpd2/modsecurity-core-rules/modsecurity_crs_23_request_limits.conf"] [line "31"] [id "960335"] [rev "2"] [msg "Too many arguments in request"] [severity "WARNING"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/SIZE_LIMIT"] [hostname "xxxx.com"] [uri "/gallery/zp-core/admin-options.php"] [unique_id "Un54ZH8AAAEABo3hJrQAAAAI"]

This is server security triggering. You have to ask your host to lower the rule involved. Or change the number of plugins per page on the options to workaround.

OK, thanks, Malte. I'll check with the provider tech support. I'll also look into the workaround option just to get around this issue for now. :o)

I have temporarily worked around the issue by removing a few plugins and was able to successfully apply the updates I wanted.

Thanks, Malte and sbillard, for your help and time. I truly appreciate it.

…Leo

You can also access the plugin options as an individual page by clicking on the "options" icon in the plugin selection.