Paypal “Access Denied” after submitting form

  • Suddenly Paypal is regecting cformsII with 403 error when the user submits the form from page 2 of the multi-part form:

    Access Denied
    You don’t have permission to access “/cgi-bin/webscr” on this server.

    I don’t think this is a cformsII problem but perhaps you may be able to give me a clue as to what you think Paypal may not like.

    There are three sites that are currently broken, one of which has been working for 5+ years. Here is one of them:
    https://www.sgcpc.org/donations-menu/donations/

    In cformsII settings:

    Core Form:
    Send form data: Enable alternative form action is checked
    https://www.paypal.com/cgi-bin/webscr

    Latest version of WordPress, cformsII, theme.
    PHP 7.3

    This is what is sent to Paypal:

    REQUEST HEADERS

    :authority: https://www.paypal.com
    :method: POST
    :path: /cgi-bin/webscr
    :scheme: https
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    accept-encoding: gzip, deflate, br
    accept-language: en-US,en;q=0.9
    cache-control: max-age=0
    content-length: 2077
    content-type: multipart/form-data; boundary=—-WebKitFormBoundaryfh1WbHX9O6wR9zRS
    cookie: KHcl0EuY7AKSMgfvHl7J5E7hPtK=UExkOzO-C6SO73DmSaoWvzetgyOBSlq0zfQCpgb3kmof20ubCTPm3x4vid9mrADzLogU7WjIpTnVbIUg
    origin: https://www.sgcpc.org
    referer: https://www.sgcpc.org/
    sec-fetch-dest: document
    sec-fetch-mode: navigate
    sec-fetch-site: cross-site
    sec-fetch-user: ?1
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36

    FORM DATA

    item_name: General donation
    amount: $1
    first_name: Paul
    last_name: Hartman
    address1: 18 1/2 Main Street
    city: Baltimore
    state: MD
    zip: 21212
    address_override: 1
    email: [email protected]
    business: YSDK3DQ74NQT2
    cmd: _donations
    image_url: https://www.sgcpc.org/wp-content/uploads/2019/01/SG-logo-transparent150.png
    return: https://www.sgcpc.org/thank-you/
    cf_working7: <span>One moment please…</span>
    cf_failure7: <span>Please fill in all the required fields.</span>
    cf_customerr7: y
    sendbutton7: Submit

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author bgermann

    (@bgermann)

    I guess PayPal has changed its API. Please read their documents how to change the request parameters.

    Thread Starter Paul Hartman

    (@paul-hartman)

    I can’t find any changes in the Paypal docs.

    Do you know what the last 4 items in the form data are? They are not anywhere in the form, even as hidden fields. I don’t know where they are coming from. Here’s what Firefox shows:

    Content-Disposition: form-data; name=”cf_working7″

    <span>One moment please…</span>
    —————————–27427764433255274236244046098
    Content-Disposition: form-data; name=”cf_failure7″

    <span>Please fill in all the required fields.</span>
    —————————–27427764433255274236244046098
    Content-Disposition: form-data; name=”cf_customerr7″

    y
    —————————–27427764433255274236244046098
    Content-Disposition: form-data; name=”sendbutton7″

    Submit
    —————————–27427764433255274236244046098–

    There are no such field names in the form. Could some other plugin be adding that to the form data when it is submitted? I don’t know how the mechanism works.

    This may not be what Paypal is complaining about, but it looks fishy.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Paypal “Access Denied” after submitting form’ is closed to new replies.

Tags