Answers.Body: <p>You're correct, this is not CiviCRM-related.</p>
  
  <p>Your Apache log is showing that <code>mod_security</code> is the culprit here.  <code>mod_security</code> is a "web application firewall" - it sits between the user and Drupal/CiviCRM.  It's used to block access to the application when it thinks the interaction is malicious.</p>
  
  <p>From the log, I can see that it's blocking part of the cookie associated with <code>ajs_user_id</code>.  A quick Google search says that <code>ajs_user_id</code> is probably tied to segment.com's <code>analytics.js</code>.  Does that ring a bell?</p>
  
  <p>The answer is to go to your webhost/sysadmin and show them this error; they should be able to change the <code>mod_security</code> logs.  If they refuse, I recommend changing webhosts.  If that's not an option, disable <code>analytics.js</code>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-11T19:45:52.870Z
Answers.LastActivityDate: 2017-10-11T19:45:52.870Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>Some people who received our big mailing get a forbidden message when they click on a link that goes to an external site. Most people are not getting the error.</p>
  
  <blockquote>
    <p>Forbidden You don't have permission to access
    /sites/all/modules/contrib/civicrm/extern/url.php on this server.</p>
  </blockquote>
  
  <p>I've tested while not logged in to our website. I've tested on various IP addresses. I've tested while logged in as several types of roles with varying permissions. It's clearly a firewall issue, but if I post it somewhere else, I may push back about it being a CiviCRM issue. Why does my server think that this harmless CiviCRM external link tracking process is a SQL injection concern?</p>
  
  <p>CiviCRM 4.7.15 Drupal 7</p>
  
  <p>Apache SSL Error log reports:</p>
  
  <pre><code>[Tue Oct 10 23:45:07.760744 2017] [:error] [pid 27564:tid 140558165042944] [client 107.77.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(^[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+|[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+$)" at REQUEST_COOKIES:ajs_user_id. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing Detected"] [data "Matched Data: \\x22 found within REQUEST_COOKIES:ajs_user_id: \\x224622165\\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "www.fosterclub.com"] [uri "/sites/all/modules/contrib/civicrm/extern/url.php"] [unique_id "Wd1bg857a7YAAGus-PcAAADK"]
  </code></pre>
  
  <p>I'm stumped because I can't reproduce the error. The error log only shows a few of these but the access log shows several times the link was successfully accessed. Can't find a pattern. </p>
  
  <p>Here is a screenshot that someone sent me.
  <a href="https://i.sstatic.net/lprEb.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/lprEb.jpg" alt="enter image description here"></a></p>
  
  <p>Edit: the file permissions for /sites/all/modules/contrib/civicrm/extern/url.php:</p>
  
  <pre><code>-rw-rw-r-- 1 drupal-user server-group 1707 Apr 17 04:44 url.php
  </code></pre>
  
  <p>Link in email: </p>
  
  <p><a href="https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&amp;qid=4531881" rel="nofollow noreferrer">https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&amp;qid=4531881</a></p>
  
  <p>CiviMail translated that link from what we put in, which is the ultimate destination. Should be an auction site.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-11T05:31:56.023Z
Comments.Text: I `chmod 775 -R sites/all/modules/contrib/civicrm/extern` and I'm hoping that will solve the problem, but I can't reproduce it in order to test...
Comments.UserDisplayName: Christia
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-11T18:16:10.720Z
Comments.Text: the link you have in the email is an 'absolute' link isn't it?
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-11T19:12:26.937Z
Comments.Text: Updated my question to include the link. I'm not sure what you mean by absolute link.
Comments.UserDisplayName: Christia
Tags: <civimail><drupal>
Title: CiviCRM Mailings external links forbidden
ThreadText: # CiviCRM Mailings external links forbidden
  
  (Asked by: username_0 on 2017-10-10)
  
  Some people who received our big mailing get a forbidden message when they click on a link that goes to an external site. Most people are not getting the error.
  
  Forbidden You don't have permission to access
    /sites/all/modules/contrib/civicrm/extern/url.php on this server.
  
  I've tested while not logged in to our website. I've tested on various IP addresses. I've tested while logged in as several types of roles with varying permissions. It's clearly a firewall issue, but if I post it somewhere else, I may push back about it being a CiviCRM issue. Why does my server think that this harmless CiviCRM external link tracking process is a SQL injection concern?
  CiviCRM 4.7.15 Drupal 7
  Apache SSL Error log reports:
  [Tue Oct 10 23:45:07.760744 2017] [:error] [pid 27564:tid 140558165042944] [client 107.77.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(^[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+|[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+$)" at REQUEST_COOKIES:ajs_user_id. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing Detected"] [data "Matched Data: \\x22 found within REQUEST_COOKIES:ajs_user_id: \\x224622165\\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "www.fosterclub.com"] [uri "/sites/all/modules/contrib/civicrm/extern/url.php"] [unique_id "Wd1bg857a7YAAGus-PcAAADK"]
  
  I'm stumped because I can't reproduce the error. The error log only shows a few of these but the access log shows several times the link was successfully accessed. Can't find a pattern. 
  Here is a screenshot that someone sent me.
  
  Edit: the file permissions for /sites/all/modules/contrib/civicrm/extern/url.php:
  -rw-rw-r-- 1 drupal-user server-group 1707 Apr 17 04:44 url.php
  
  Link in email: 
  https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&qid=4531881
  CiviMail translated that link from what we put in, which is the ultimate destination. Should be an auction site.
  
  **Tags:** civimail, drupal
  
  > **Comments:**
  > **username_0**: I `chmod 775 -R sites/all/modules/contrib/civicrm/extern` and I'm hoping that will solve the problem, but I can't reproduce it in order to test...  
  > **username_1**: the link you have in the email is an 'absolute' link isn't it?  
  > **username_0**: Updated my question to include the link. I'm not sure what you mean by absolute link.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2017-10-11. Score: 2 | Accepted answer
  
  You're correct, this is not CiviCRM-related.
  
  Your Apache log is showing that `mod_security` is the culprit here. `mod_security` is a "web application firewall" - it sits between the user and Drupal/CiviCRM. It's used to block access to the application when it thinks the interaction is malicious.
  
  From the log, I can see that it's blocking part of the cookie associated with `ajs_user_id`. A quick Google search says that `ajs_user_id` is probably tied to segment.com's `analytics.js`. Does that ring a bell?
  
  The answer is to go to your webhost/sysadmin and show them this error; they should be able to change the `mod_security` logs. If they refuse, I recommend changing webhosts. If that's not an option, disable `analytics.js`.
  
  
  ---
  
  