403 error saving event after edit in front end

Hello,

What is the URL they are getting the 403 on?

Many thanks
Tony

The URL for editing the event is:

http://www.ssyc.org/for-members/calendar/icalevent.edit/4408?rp_id=12955&year=2018&month=01&day=04

A save generates the 403 on this URL:

http://www.ssyc.org/for-members/calendar/month.calendar/2017/12/04/-

Use the logon credential I provided. And edit will work just fine with the ID ending in admin, but will fail with the ID ending in board. The first ID has administrator rights, and the edit page looks correct and includes the proper editor buttons, etc. The second ID is defined as part of the group "board", and the page that is presented when editing does not include the editor buttons, and fails during the save process.

(See site details for more info.)

Can you please give me super user rights, something is very bizarre here.

Ideally FTP too.

Many thanks
Tony

Tony,

The admin account has been changed to super user.

FTP is restricted by IP address in the firewall, so I can't give you that.

The Extplorer component is installed, and can function similar to FTP.

The site is running under PHP 7.0.26, although I don't think that's an issue here.

Dave

Thank you I have found an issue and updated the file icalevent.php in: /components/com_jevents/controllers/

but it doesn't seem to be taking effect on your site? I've added it here for you too.

Many thanks
Tony

I installed your new file (the original still exists in the directory as icalevent-old.php). I then restarted IIS just to make sure everything is fresh.

The problem still exists.

I also noticed that eXtplorer wasn't functional. After a bit of research, I found that eXtplorer is not compatible with PHP 7. So I reverted the site to PHP 5.6.24.

Dave

I assume that you are familiar with eXtplorer. If not, you'll find it a bit quirky. You can't replace an existing file. But, you can rename a file and then copy a new one in.

Dave

Tony asked me to take a look at this. I think the issue could be due to the fact that you appearing to be wanting to allow board members to edit and publish events but not to be able to create them. A lot of the code has an implicit expectation of permission - after all if you can edit any event you can take any existing event and change its date, description, title etc. in essence make a new event out of it. So we tend to check for permissions to create in various places in the code.

I have modified the permission handling in the code to allow these checks to be either event creator or editor so I think its now resolved on your server (please confirm).

But I would suggest you think through your logic of not allowing event creation for the reasons I described above

Thank you for your help on this.

We actually do want to keep things as they are, with the club's office controlling the calendar in terns of creating events, but allowing board members to update them. What we are asking the board members (who happen to all be chairmen of committees) to do is to update the calendar entries of their meetings and add the meeting agenda.

I turned off Joomla debug mode, which was blocking the edit popup, and now it is working as I would like it to. Both an administrator and a member of the board group are able to edit events in the front end.

There is still one issue, however. It is related, but not a 403 error. The issue is that the editing "buttons" of the JCE editor are not being displayed on the edit page. They are displayed for an administrator, but not for a user assigned to the board group. When I say "buttons" I really mean all of the options associated with the editor. All this is being displayed on the edit page is an empty box. Again, it works correctly for me, since I have administrator privileges, but not for a non-administrator.

I've attached a screen shot. Note that there are no editor buttons associated with the Description box.

Would you like me to open a new ticket, or are you willing to pursue it through this one?

(I had setup a user for you assigned to the group "board" that you can use to test. Of course, since i also setup a user with admin privileges, you can define a user yourself.)

Thanks again for your help.

Dave

I suspect this is a JCE setup issue. In JEC you can have different user groups with different options and buttons.

Thank you for all of your help on getting this resolved.

The JCE issue was indeed an issue in the JCE configuration.

Hello everybody. I have a similar issue, but my error code isn't 403 but 400. The unespected status gets me from /calendario/month.calendar/2018/01/24/-

I have to be honest: I didn't understand how you could resolved it, but I guess has to do with users authorizations. I have a superuser who can smoothly create and edit events in Fron End. Then, I created a new group based on Manager, and named it "calendario". In the Jevents configuration, gave that group permissions to create, publish and edit both own and other user's events.

Then, assigned a new user to than group, log in Front End, clic on "New event" and filled up event's details. But when I clic "save", that error appears.

What do you recommend?

JEvents 3.4.33
PHP 5.6.27

Thanks in advanced.

Hello,

Could you post a screenshot of your error? Since a 400 error is usually a timeout/bad request error on the server.

What version of Joomla!? JEvents is on 3.4.43 so I would upgrade that firstly.

Many thanks
Tony

Hello,

Could you post a screenshot of your error? Since a 400 error is usually a timeout/bad request error on the server.

What version of Joomla!? JEvents is on 3.4.43 so I would upgrade that firstly.

Many thanks
Tony

Thanks for your response.
I'll attached a screenshot. I'm using Gantry Framework.
Joomla is 3.6.x, because I'm using a Moodle/Joomla hybrid and could't upgrade all yet. I'm going to upgrade JEvents first.

Just a comment: My two superusers can create events from Frontend without trouble, so I was considering to change the JEvents Administrator Level (actuall: Superuser) to Manager and see what happens. By the moment can't give it a try in a development enviroment, so I have to wait until midnight to upgrade or mayor changes.

Thank you again.

Juan Carlos

Hello,

Could you post a screenshot of your error? Since a 400 error is usually a timeout/bad request error on the server.

What version of Joomla!? JEvents is on 3.4.43 so I would upgrade that firstly.

Many thanks
Tony

Thanks for your response.
I'll attached a screenshot. I'm using Gantry Framework.
Joomla is 3.6.x, because I'm using a Moodle/Joomla hybrid and could't upgrade all yet. I'm going to upgrade JEvents first.

Just a comment: My two superusers can create events from Frontend without trouble, so I was considering to change the JEvents Administrator Level (actuall: Superuser) to Manager and see what happens. By the moment can't give it a try in a development enviroment, so I have to wait until midnight to upgrade or mayor changes.

Thank you again.

Juan Carlos

Good day.
I have upgraded JEvents to 3.4.43. Same issue. I'll try creating a new calendar with new admins, and see...

Keep you posted.
JC

Good day, everyone...
I found just a tip, and maybe it's related. Under "configuration", having "Advanced" enabled, the first tab called "Component", there is a mark called Category separator, which present a "|". The tooltip says that, if a 400 error occurred, I should change the "|" for a comma ",". I did it and... same issue.


I have another question with my issue: How does JEvents determine which users appears at the dropdown selector of users? First I thought that only Managers, Administrators or Superusers (from Joomla groups), but now I see a bunch of users that doesn't have those privileges. Maybe it is related, maybe not, but I consider important to comment it in here. My users are members only from Administrator group, and two Superusers. It only work for the Superusers guys.

So far, no luck yet.
Greetings.
JC

What do your error logs say?

They are determined by who can create events within the JEvents Permissions.

Many thanks
Tony