With "Remote login" option enabled, getting a 403 on the included script tag

  • Hello. On some of the networks I am running, when I enable the Remote login option, the sites load fine with the mapped domains, but in my browser console I’m getting a 403 error on the domain mapping script tag that gets included in <head>. (The one making a call to the primary site with the ?dm=xxx… query string.)

    Any ideas why this would be? It’s weird because I’m not getting the errors on one of the networks, but I am on the others.

    Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Ron Rennick

    (@wpmuguru)

    My first guess would be security running on the client browser. An exception may have been approved for one domain but not another.

    Thread Starter rlgrobert

    (@rlgrobert)

    Thanks for the reply. I don’t remember doing anything with the browser security for the domains on the network that is working properly. Is there a way to test if this is the issue?

    Could it be a file permissions issue somewhere? Oh, and I just noticed that the error is showing in Chrome and Safari (webkit) but not Firefox.

    Any ideas on how I could debug this?

    Plugin Author Ron Rennick

    (@wpmuguru)

    I don’t have Safari but I did check chrome and didn’t get anything in the console.

    Unfortunately, I only use Chrome for testing and I’m not all that familiar with the settings/internals of it so I can’t give you much direction.

    I realize this is a pretty old thread, but I had the same issue and wanted to post the solution I figured out in case anyone else came googling here.

    The short story – it’s caused by the “.” (period) in the domain name that gets loaded in the “back” parameter of the script. Example:

    https://somesite.com/?dm=abc123&action=load&blogid=6&siteid=1&t=123
&back=http%3A%2F%2Fsomeothersite.com%2F

    My solution is pretty hack-ish, but here’s what I did:

    1. Open domain-mapping.php
    2. Add this at line 255:
      $_GET['back'] = str_replace('_','.',$_GET['back']);
    3. Then replace line 799 with this:
      echo "<script src='{$protocol}{$current_site->domain}{$current_site->path}?dm={$hash}&action=load&blogid={$current_blog->blog_id}&siteid={$current_blog->site_id}&t=" . mt_rand() . "&back=" . str_replace('.','_',urlencode( $protocol . $current_blog->domain . $_SERVER[ 'REQUEST_URI' ] )) . "' type='text/javascript'></script>";
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘With "Remote login" option enabled, getting a 403 on the included script tag’ is closed to new replies.