Resolved unable to download exe file 403 error

[drusixtynine]

Hi there,
I want to put an exe file to be downloadable for my website visitors,
Here is the page Installation de TDF
Cllicking on the download button fires an 403 error
The log file shows this
[Mon Jul 20 00:01:12.998539 2020] [authz_core:error] [pid 29661] [client MYIPADDRESS:55344] AH01630: client denied by server configuration: /var/www/vhosts/muchosoft.com/httpdocs/software/tdf/INSTALL/INSTALL.EXE
Thanks for any help that you guys could give

 

[IgorG]

Website is not accessible: 403 Forbidden AH01797: client denied by server configuration

Applicable to: Plesk for Linux Symptoms The website shows the error similar to below one in browser screen: CONFIG_TEXT: 403 Forbidden in some configuration site unavailable with 504 TimeO...

support.plesk.com

 

[drusixtynine]

Hi and thanks for the answer,
The problem is that it is not the same error, mine is AH01630 and not AH01797
Anyway, I tried the solution and there is nothing in the "Apache & Nginx settings"
There is no .htaccess file either

 

[Bitpalast]

Maybe ModSecurity is blocking the request. Try to turn of the "web application firewall", then try the download again.

 

[MarcusR]

Same problem here AHO1630 - trying to download .exe file from host.

httpd.conf

<LocationMatch ".+\\.(?i:psd|log|cmd|exe|bat|csh|sh)$">
            Require all denied
</LocationMatch>

is the problem.

is there a way to allow this through .htaccess?

 

[drusixtynine]

I found a solution here Unable to open PSD, LOG, CMD, EXE, BAT, CSH or SH file: 403 Forbidden

 

[drusixtynine]

My original problem is back again.... and the solution I have found at that time is now unavailable and I can't remember how to fix it...
Can someone help please??
This link brings a 403 error... it was litterally working a week ago

 

[Bitpalast]

"AH01630: client denied by server configuration:" means that the web server does not allow you to access the file by design, e.g. by a rule in your .htaccess file, a password-protected directory or something similar. Have you checked the contents of your .htaccess file?

 

[drusixtynine]

No I didn't beforehand but it's very basic, here it is
# BEGIN WordPress
# Les directives (lignes) entre « BEGIN WordPress » et « END WordPress » sont générées
# dynamiquement, et doivent être modifiées uniquement via les filtres WordPress.
# Toute modification des directives situées entre ces marqueurs sera surchargée.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

The website is very basic on wordpress, but it is a one page that links to another site.
The problem is in download pages like this one Installation de GESTIAA and the download button (in french) links to an install.exe file does not work
Any other idea??

 

[Bitpalast]

Have you tested the full path for .htaccess files? You are showing the top level WP .htaccess, but what about the subdirectories that lead to
./software/tdf/INSTALL/INSTALL.EXE
?
And I forgot to mention: We have had several customers who accidentally placed an .htaccess file into their subscription root directory, so actually outside the httpdocs, but this also applies. So only to be sure you need to check the full path starting from the subscription root down to the file whether there is an access restriction involved.

 

[drusixtynine]

None is there, there is no htaccess in any root folder up to the file folder... maybe I need to put one??
Could it be something that I need to change in plesk?

 

[Bitpalast]

Here is another idea: In the Wordpress Toolkit "Security" settings there is an option that is called "Block access to potentially sensitive files". If that is checked, you cannot download file types like the above mentioned exe. Could you please check if that setting is active, in case it is deactivate that and try again?

 

[drusixtynine]

Well done, that was it. I just reverted "Block access to potentially sensitive files" and it's back to normal
Thank you so much for the follow up

 

[W4ru]

"Block access to potentially sensitive files"

This setting also blocks access for exe-files stored in Nextcloud in the same domain. Even if Wordpress and Nexcloud are installed in different directories.

Thank you very much Peter!
I searched in Nextcloud and nginx for a very long time without success. I couldn't figure out that it was the wordpress toolkit.