internetarchive / internetarchive/openlibrary

Unable to save editions config as admin user: 403 Forbidden

Open
#13,624 1 comment 0 reactions 0 assignees View on GitHub
Affects: Admin/Maintenance Lead: @mekarpeles Module: Modsecurity Needs: Breakdown Needs: Investigation Needs: Staff / Internal Priority: 3 Type: Bug
Dominant language
Python
Stars
6.7k
Forks
2k
Avg merge
2d 19h
Merged PRs (30d)
138

Description

### Problem

Unable to save editions config as admin user: 403 Forbidden

URL: https://openlibrary.org/config/edition.yml

with params `?m=edit`

I can load the .yml, and the edit interface, but saving as is results in 403 Forbidden

The repeated 403 modsecurity reports blocking legitimate workflows suggest that OL has just thrown in a bunch of default modesecurity rules.

It'd be really good if there were some role-aware exclusions for authenticated admin and librarian workflows.

Is that something that can be done?

I'm trying to add the identifier change commited in:
https://github.com/internetarchive/openlibrary/pull/13622/changes#diff-48f1edeae0946a42d6077aeb6c5eefafb0d223e817b9e36ed6e85c805ba4cfb4R32-R36

modsecurity rules appear to be blocking basic admin tasks from ever succeeding.

### Breakdown

Implementation Details (for maintainers)

#### Requirements Checklist
* [ ]

#### Related files

*

#### Stakeholders

*


#### Instructions for Contributors

- Please [run these commands](https://docs.openlibrary.org/developers/tools/git.html#working-on-your-branch) to ensure your repository is up to date **before** [creating a new branch](https://docs.openlibrary.org/developers/tools/git.html#making-changes-and-creating-a-pull-request) to work on this issue and **each time after** pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the save request for config/edition.yml?m=edit as an authenticated admin and review the associated ModSecurity reports. Compare the blocked request with the identifier change referenced in PR #13622. Done means authorized admin and librarian workflows can save the configuration without 403 responses while unrelated protections remain effective.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.