Uploaded image for project: 'phpBB'
  1. phpBB
  2. PHPBB-17372

Apache update: %3f in URL generates 403 error

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Invalid
    • Icon: Major Major
    • None
    • 3.3.12
    • None
    • None
    • phpBB 3.3.12, Apache 2.4.61, PHP 8.2.20, Unix

      Since Apache version 2.4.60 (July 1st) question marks in a URL encoded with %3f produce a 403 error. This affects the Apache default settings.

      Various phpBB pages produce an URL in which the question mark is encoded with %3f in the redirect variable. We now get a 403 error there.

      This affects the quick moderator tools located at the end of each topic at the bottom of the page. And this affects the login if you are not on the homepage, i.e. you come from a subpage. Maybe other pages that I didn't notice. It always affects the redirect variable. 

      The Apache change is to deal with: https://www.cve.org/CVERecord?id=CVE-2024-38474

      A normal hoster will not change the default settings, so I think this is a bug and it will affect many users soon.

            Marc Marc
            Eisrose Eisrose
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: