5

I am getting this error for my website which is built on magento-1.9.0.

2015/07/13 05:50:44 [error] 1371#0: *491517 access forbidden by rule, client: **.***.***.***, server: www.example.com, request: "POST /app/etc/local.xml HTTP/1.1", host: "www.example.com"

For your information: the IP address is always my own server. This only happens whenever I try to edit or update any item of "Shopping Cart Price Rules". There was a magento bug of shopping cart price rule and I have used a extension which is mentioned here https://github.com/husseycoding/cartrulefix . That extension works perfectly in my local environment however it is also not working in live. I guess this error is preventing that extension to work perfectly. My live server is running on nginx.

Could someone please help me? Thanks in advance.

  • @fschmengler: Thanks for your help. Does this mean that I have to set permission via SSH for that file so that it's become inaccessible? – Mohammad Faisal Ahmed Jul 13 '15 at 6:34
  • It's already the case ("access forbidden by rule"). Actually these messages are a good thing, Magento would warn you in the admin panel if it could access the file via HTTP – Fabian Schmengler Jul 13 '15 at 6:35
  • @fschmengler: However, it's not warning me in the admin panel, instead, it's giving me this message in the error log of nginx. – Mohammad Faisal Ahmed Jul 13 '15 at 6:38
  • Yes and that means, everything is fine. Magento tries to access app/etc/local.xml via HTTP which fails, so you get this error log. And the point is, that it should fail! Otherwise everybody could see your database credentials. – Fabian Schmengler Jul 13 '15 at 6:39
7

Since Why does Magento POST to its own app/etc/local.xml? might not have been clear enough, I'll add this as an answer:

Actually these messages are a good thing, Magento would warn you in the admin panel if it could access the file via HTTP. If you see this log message, everything is fine. Magento tries to access app/etc/local.xml via HTTP, which fails, so you get this error log. And the point is, that it should fail! Otherwise everybody could see your database credentials, by accessing http://example.com/app/etc/local in the browser.

However, if these log messages annoy you and you are confident that your server setup will stay as secure as it is, you can easily remove this feature:

Getting rid of the security notification

To get rid of this security check, do not attempt to hack the Magento core (as some forum threads have suggested in the past). Instead, you can just modify the admin-theme to remove this check. Open up the following file or create it if it does not exist:

app/design/adminhtml/default/default/layout/local.xml

Then add the following code to it:

<layout>
    <default>
        <remove name="notification_security" />
        <remove name="notification_survey" />
    </default>
</layout>

This removes the blocks notification_security and notification_survey from the backend-pages entirely, skipping therefor the security check. No core hacks involved.

Source: http://www.yireo.com/tutorials/magento/magento-administration/1322-client-denied-by-server-configuration-appetclocalxml

Remember to clean the layout cache afterwards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.