internetarchive / internetarchive/openlibrary
Unable to save editions config as admin user: 403 Forbidden
- Dominant language
- Python
- Stars
- 6.7k
- Forks
- 2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 138
Description
### Problem
Unable to save editions config as admin user: 403 Forbidden
URL: https://openlibrary.org/config/edition.yml
with params `?m=edit`
I can load the .yml, and the edit interface, but saving as is results in 403 Forbidden
The repeated 403 modsecurity reports blocking legitimate workflows suggest that OL has just thrown in a bunch of default modesecurity rules.
It'd be really good if there were some role-aware exclusions for authenticated admin and librarian workflows.
Is that something that can be done?
I'm trying to add the identifier change commited in:
https://github.com/internetarchive/openlibrary/pull/13622/changes#diff-48f1edeae0946a42d6077aeb6c5eefafb0d223e817b9e36ed6e85c805ba4cfb4R32-R36
modsecurity rules appear to be blocking basic admin tasks from ever succeeding.
### Breakdown
Implementation Details (for maintainers)
#### Requirements Checklist
* [ ]
#### Related files
*
#### Stakeholders
*
#### Instructions for Contributors
- Please [run these commands](https://docs.openlibrary.org/developers/tools/git.html#working-on-your-branch) to ensure your repository is up to date **before** [creating a new branch](https://docs.openlibrary.org/developers/tools/git.html#making-changes-and-creating-a-pull-request) to work on this issue and **each time after** pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.
Contributor guide
Research direction
Start by reproducing the save request for config/edition.yml?m=edit as an authenticated admin and review the associated ModSecurity reports. Compare the blocked request with the identifier change referenced in PR #13622. Done means authorized admin and librarian workflows can save the configuration without 403 responses while unrelated protections remain effective.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100