1041315 - Lightning UA will trigger 403 Forbidden Error on some sites

Status: RESOLVED INVALID

(SeaMonkey :: General, defect)

Description

[Goeran Schmidt]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:29.0) Gecko/20100101 Firefox/29.0 SeaMonkey/2.26.1 (Beta/Release)
Build ID: 20140612174402

Steps to reproduce:

Using Seamonkey 2.26.1 with Lightning 3.1b1. If it try to access a website in the browser tab (http://www.primesearchteam.com/ - vBulletin Board Version 3.7.0), either by clicking at a link or enter the address directly in the address bar, I got a 403 Forbidden Error from the webserver.


Actual results:

The forum sites working in save mode correctly at seamonkey. So I start seamonkey normally, deactivate all add-ons in seamonkey and activate every add-on one after another and try to reach the website.

Once the Lightning Add-On is activated, I got the 403 Forbidden Error from the forum website. It is curious, because lightning is working at the mail client, and not in browser. But it's reproducible.

Also if I try to reach a site directly (for instance index.php), I get this error.


Expected results:

The forum sites should load normally.

Comment 1

[Philip Chee]

http://www.whatsmyuseragent.com/

Mine is apparently: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0 SeaMonkey/2.30a1 Lightning/3.5a1

I guess that somehow the "Lightning/3.5a1" part of the UA is confusing the  vBulletin Board software.

Comment 2

[Ian Neal]

(In reply to Philip Chee from comment #1)
> http://www.whatsmyuseragent.com/
> 
> Mine is apparently: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0)
> Gecko/20100101 Firefox/33.0 SeaMonkey/2.30a1 Lightning/3.5a1
> 
> I guess that somehow the "Lightning/3.5a1" part of the UA is confusing the 
> vBulletin Board software.

Tested using Firefox 30.0 with User Agent Overrider 0.2.4 and a UA string set to the same as Philip's, gives the 403 error too -> Problem with site / VBulletin Board software.

Site is using vBulletin 3.7.0, the last version of 3.x was 3.8.7 and that is now considered "End of Life".

The supported versions (according to vBulletin web site) are 4.2.x, 5.0.x and 5.1.x

Tested against v5.1.2 (http://www.vbulletin.com/forum/forum) and that version does not appear to have the issue, please could you test?

Comment 3

[Ian Neal]

Just tested with http://www.e90post.com/forums/ which is also says it is using 3.7.0 and that doesn't block, so very much looks like it is something that http://www.primesearchteam.com/ is doing specifically. Do you have a way of contacting the site administrators?

Comment 4

[Goeran Schmidt]

Yes, I have and I will ask. I also tracked down, that the "read only when logged in" function not causing the problem. I found some other older 3.x vbulletin with this function activated and did not get this error.

Tested with:
3.6.5 (http://www.donmurphy.net/board/)
3.7.2 (http://forums.martasystems.com/)
3.8.7 (http://gallifreybase.com/forum/)

Comment 5

[Goeran Schmidt]

> Tested against v5.1.2 (http://www.vbulletin.com/forum/forum) and that
> version does not appear to have the issue, please could you test?

This also works on my side.

Comment 6

[Wayne Mery (:wsmwk)]

Goeran, do you still see this problem?

> I guess that somehow the "Lightning/3.5a1" part of the UA is confusing the  vBulletin Board software.
How would this be our problem?

Comment 8

[bblack]

The same problem with:

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 SeaMonkey/2.53
Build identifier: 20180930130000

Lightning Version: 5.8
BuildID: 20180515174338

on https://veganedinburgh.com/

please refer Bug: 1495680

Error only occurs if Lightning is enabled.

Comment 9

[bblack]

This is not an Error from Seamonkey or Lightning.
But maybe a problem of Seamonkey and Lightning.

There are more sites with this error:

https://www.dherst.gov.pg/index.php/heat-form
https://aiec.coop/
https://www.mobius-actioncam.com/
https://www.300mclub.org/
https://aiec.coop/login/
https://veganedinburgh.com/
.....

The error is triggered on the servers by the user agent string.
If the UA contains "ning", the error message appears. 
It does not have to be "Lightning" included.
The error is also triggered by "abcningxyz".

To avoid the error, delete or change the calendar.useragent.extra. string.

calendar.useragent.extra = "Calendar/5.8" or "Lightn!ng/5.8" works.
"LightnIng/5.8" or "LightNING/5.8" don't work.

Maybe we should change that, even if the error is on the server.

Comment 10

[[:MakeMyDay]]

Thanks for digging into the issue. This looks like a poor man's detection to prevent requests from ning, so something to fix by the websites you listed. But apart from that, the question is why SM uses the calendar user agent for browsing websites? That is clearly a calendar prefernce and calendar doesn't do any http requests other then to query network calendars as configured by the user.

That said, this doesn't look like a calendar issue, so I'm moving this to SM.

Comment 11

[Frank-Rainer Grahl (:frg)]

As already stated. The website needs to be fixed. Advertizing Lightning can be turned off in the preferences. I see no chance to do this dynamically based on website content. If you turn it off and need it for specific websites you might need to use an user agent override for the site.

Comment 12

[bblack]

For future error detection of this kind:

1. Please contact the webmaster of the website to correct the incorrect Ning detection.

2. To be able to access the website first:
   Turn off Advertising Lightning (Edit/Preferences... Advanced -> HTTP Networking).

Comment 15

[bblack]

The affected sites from above have all been corrected.