403 (Forbidden) en consulta a base de datos

gcuello

Estoy obteniendo este error
funcionesJS_trans.js:680 GET http://transcoord.gcuello.serv00.net/php/consultasql.php?seleccion=SELECT%20siscoorgeodesicas.*%2Cdatumhor.nombre%20AS%20nombre_datumhor%2Celipsoides.nombre%20As%20nombre_elipsoide%2C%20uso.nombre%20AS%20nombre_uso%2Cuso.lat1%20AS%20ulat1%2Cuso.lon1%20AS%20ulon1%2Cuso.lat2%20AS%20ulat2%2Cuso.lon2%20AS%20ulon2%20FROM%20siscoorgeodesicas%20JOIN%20datumhor%20ON%20siscoorgeodesicas.datumhor%3Ddatumhor.codigo%20JOIN%20elipsoides%20ON%20datumhor.elipsoide%3Delipsoides.codigo%20JOIN%20uso%20ON%20siscoorgeodesicas.uso%20%3D%20uso.codigo%20WHERE%20siscoorgeodesicas.codigo%20%3D%20%27CAMPO%20INCH_coordinate_system%27 403 (Forbidden)

en esta llamada

fetch('./php/consultasql.php?seleccion=' + encodeURIComponent(cad))
.then(response => {
if (!response.ok) {
throw new Error('Network response was not ok ' + response.statusText);
}
return response.json();
})
.then(data => {
var ventana = document.getElementById("campos_ventana");
ventana.innerHTML = ""; // limpiar ventana
var map = document.getElementById('map');
if (map !== undefined && map !== null) {
map.innerHTML = ""; // limpiar mapa
}
generarventana(data, ventana);
})
.catch(error => {
console.log('Error en la solicitud: ', error);
});

a esta funcion de PHP

<?php

require_once "../php/funcionesPHP.php";

$cadena = $_GET['seleccion'];
$base = conexion();
$consulta = $base->query($cadena);

if($consulta->rowCount()>1){
$resultado = $consulta->fetchAll(PDO::FETCH_ASSOC);
}else{
$resultado = $consulta->fetch(PDO::FETCH_ASSOC);
}

$resul= json_encode($resultado);

echo $resul;
$base=null;

cual es el problema ?

admin

gcuello ¡Hola!

Probably your request was blocked by WAF. You can disable WAF for your domain and try again.
You can also tell us the domain and time of blocked request occurrence and we can look for the fix in our WAF's rules.

https://docs.serv00.com/WAF/

PS Please post only in English

gcuello

Dear, disabling the firewall solved the 403 error problem. I think this error originated from the complexity of the SQL query sent.

This is the query I sent in the $.ajax url:

./php/consultasql.php?seleccion=SELECT siscoorgeodesicas.*,datumhor.nombre AS nombre_datumhor,elipsoides.nombre As nombre_elipsoide, uso.nombre AS nombre_uso,uso.lat1 AS ulat1,uso.lon1 AS ulon1,uso.lat2 AS ulat2,uso.lon2 AS ulon2 FROM siscoorgeodesicas JOIN datumhor ON siscoorgeodesicas.datumhor=datumhor.codigo JOIN elipsoides ON datumhor.elipsoide=elipsoides.codigo JOIN uso ON siscoorgeodesicas.uso = uso.codigo WHERE siscoorgeodesicas.codigo = 'CAMPO INCH_coordinate_system'

This is a Log entry with the query that caused the 403 error:

179.62.90.252 - - [03/Jul/2024:13:53:42 +0200] "GET /php/consultasql.php?seleccion=SELECT%20elipsoides.linuni,primeridiano.anguni%20FROM%20siscoorgeodesicas%20JOIN%20datumhor%20on%20datumhor.codigo=siscoorgeodesicas.datumhor%20JOIN%20elipsoides%20ON%20elipsoides.codigo=datumhor.elipsoide%20JOIN%20primeridiano%20on%20primeridiano.codigo=datumhor.priMeridiano%20WHERE%20siscoorgeodesicas.codigo=%274172%27 HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"

I hope this information is useful for you to review the WAF rules.

Thank you

admin

gcuello Sending SQL query and executing it in a direct way is not a safe practice and we recommend changing that behavior. We keep our WAF rules to block such activity.

gcuello

I solved the problem by using promises with the POST method to pass only the necessary data and resolving the query on the server side. Set level 1 to WAF again. Thank you for your recommendations.