Search term with apostrophe gives 403 error

[cfish]

Generally, my board works fine and the search works perfectly except...

If a user enters one or more search terms that include an apostrophe such as the word "can't", the search returns a valid list of threads which looks fine. However, if the user clicks on any of the links to view that thread, they get a 403 "Forbidden" error.

Could this be something to do with the "highlight=" terms appended to the URL? I see that the highlight term "can't" is appended as highlight=can%27t. Or is it a magic quote issue or maybe a character set issue...

[Marco van Herwaarden]

I can not duplicate this problem here at vbulletin.com.

To troubleshoot this, please remove any hacks and disable your plugins, then see if you still have this problem.
Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

If so, reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

If your problem still exists, please create a new Style with no Parent set. Now browse the forum using this new style, do you still have the same problems?

[Freddie Bingham]

Probably a mod_security issue

[cfish]

OK, I disabled all plugins using your config.php change and I set the style back to the default vB style so no products/plugins or template hacks were being used. No other files have been altered.

I also changed the characterset back to the default (I was using UTF-8).

The problem is still there.

Since I still seem to have this problem with a "virgin" vB board, I'm guessing this must be a server/apache issue?

Any ideas?

[cfish]

Bingo!

Probably a mod_security issue

OK, so I added a .htaccess file to my forum folder as described in this thread: http://www.vbulletin.com/forum/showthread.php?t=167121

...and everything now works as it should.

I don't know what mod_security is but it looks like the .htaccess just turns it off. Is this a good idea? Is there a better way to configure mod_security rather than just turning it off?

[cfish]

Unhappy Web Host

My web host was VERY unhappy about Zachery's .htaccess fix and I have been asket to remove it. They believe this is a major compromise to security.

So, what I need to know is: what is the best way to configure mod_security to allow vB to function correctly?

[cfish]

A solution

The problem has now been solved with a tweak to the mod_security filter.

This is the bit:

#SecFilterSelective ARG_highlight "(\x27|%27|\x2527|%2527)"

[Freddie Bingham]

If your webhost doesn't like you disabling mod_security via .htaccess then they shouldn't have it configured to allow you to disable it.

[cfish]

They don't allow it at all on their shared and reseller servers but I have a little more control, being on a VPS.

However, it does look as though the issue is now resolved but it would be good to know what the recommended settings for mod_security are for a pain-free vBulletin deployment.