Photo Gallery Forums

Posted: **29 Jun 2022, 15:25**

Hi,

I am reinstalling my server and reinstalling X3
When calling x3_installer.php I get this error :

PHP cURL Fail

Although your server has PHP cURL installed, we failed to access the remote X3 ZIP file. This is likely because your server does not allow cURL to external resources for security reasons.

However, below is the info from phpinfo() :

I also tried out

function has_curl(){
  if(extension_loaded('curl') && function_exists('curl_version') && function_exists('curl_init') && function_exists('curl_setopt') && function_exists('curl_exec') && function_exists('curl_close')) return true;
  return false;
}

and I get true...

so I am not sure what to try...I don't find any information online as to what is the config to put in php.ini in order to allow remote host for cURL...
I have a VPS, so full access to everything..

Thanks for your help !

Posted: **29 Jun 2022, 23:53**

I haven't actually specifically resolved this earlier, but does your machine have any firewall or security feature that may be blocking the PHP request from making external calls? That would perhaps be my first suspect, because PHP cURL itself doesn't have any options to enable/disable external url's.

It could also be something abstract, for example if your system clock is not accurate, the SSL verification will fail for the requested https url.

I had a closer look at exactly where the error message comes from, and it's because curl_init() simply fails on line 170 ... likely because it's a remote url.

$ch = @curl_init($url);

Although it won't resolve the issue, you might be able to get more information about the error by adding the following at the top of the PHP:

// display all errors to catch anything unusual
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

... and removing the @ in the function call ...

$ch = curl_init($url);

Posted: **30 Jun 2022, 03:48**

I added the lines on top and removed all the @ in function calls...nothing is displayed on top..
I tried just for testing changing

$ch = curl_init($url);

to

$ch = curl_init($urltest);

and correctly got an error displayed on top
how to test that "It could also be something abstract, for example if your system clock is not accurate, the SSL verification will fail for the requested https url." ?
no other firewall or anything..
i am behind cloudflare (only DNS, not proxied) and I have a docker
could it MAYBE be related to ownership/folder permissions ? (that's actually the reason why I want to reinstall, i messed up the folder permissions and to make it easier i am reinstalling rather than manually changing all folders permissions (website is working fine except when i want to update pages, it tells me "can't write to /content")

Posted: **30 Jun 2022, 04:31**

hyc wrote:
Code
$ch = curl_init($urltest);
and correctly got an error displayed on top

But what has you set $urltest to? That would have to be an URL.

Ultimately, the problem would likely be that your cURL doesn't trust requests to EXTERNAL hosts (eg. not on your server). I say that because it's not unusual for cURL to be blocked like this, and it's a logical precaution. You could test this yourself by setting up a local PHP script to 1. load a local file /test.txt by cURL and 2. load a file from a remote website https://somewebsite.com/test.txt by cURL. Likely, first will succeed and second will fail. If not even the local request works, then you have a bigger problem, but that is highly unlikely as long as the file is available by request.
https://www.php.net/manual/en/curl.examples-basic.php
https://startutorial.com/view/php-curl

hyc wrote:how to test that "It could also be something abstract, for example if your system clock is not accurate, the SSL verification will fail for the requested https url." ?

That was just an example to propose it could be something we simply don't know. First you would do the test above and make sure cURL works at least for LOCAL files. Then you could try to make a request to a NON-HTTPS server for a file http://somewebsite.com/test.txt ... I doubt this is related.

hyc wrote:i am behind cloudflare (only DNS, not proxied) and I have a docker

Can't see how this is related.

hyc wrote:could it MAYBE be related to ownership/folder permissions ?

I can't see how this is related either. CURL requests will read the REMOTE server (if the local cURL allows it). It could only be related if you for some reason are not allowed to write the files that are downloaded, but that wouldn't trigger an error in the cURL request.

Ultimately, I don't know enough about this, sorry. The reason I mention the "remote url" issue, is because it's NORMAL for many hosts to BLOCK cURL requests to external url's. WHY? Because external cURL requests could be used by malicious scripts to download malicious content to the server. I would guess that the same mechanism that does this, is in place on your server. In conclusion, your cURL refuses to download from remote server, and this needs to be resolved ... I really can't know why that happens on your server, but it is not unusual.

Posted: **30 Jun 2022, 04:35**

You can run cURL from your command line terminal? If so, you can test if cURL works from there ... For example run this:

curl -I https://www.photo.gallery/download/test.zip

Posted: **30 Jun 2022, 05:06**

> But what has you set $urltest to? That would have to be an URL.
I was only testing if the error_reporting was working well, just testing with a fake/wrong variable to trigger the error reporting on purpose (to ensure that if nothing was displayed, it was not due to error_reporting)

I tried this:

curl -I https://www.photo.gallery/download/test.zip

and got:

$ curl -I https://www.photo.gallery/download/test.zip
HTTP/2 503
date: Thu, 30 Jun 2022 09:01:53 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IfPnNpLjGphZpCxL0E8ZgrLGZU2x6xgMUJ3cpxBlyQ6wcBDzFYbLx9i9nl%2BBt2nVgZrNPlnPpHqmVVj8FMvS3HjPC%2F5eFZLt%2B8z0MpPrKT9y5xJ5ie94JflQ2SIebn2aZhBjiRiHET0Gkls50YUaOw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7235b846b9a29bc2-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

but i think this is your cloudflare protection, not my cloudflare because this works:

$ curl -I https://example.com
HTTP/2 200
content-encoding: gzip
accept-ranges: bytes
age: 369339
cache-control: max-age=604800
content-type: text/html; charset=UTF-8
date: Thu, 30 Jun 2022 09:28:27 GMT
etag: "3147526947"
expires: Thu, 07 Jul 2022 09:28:27 GMT
last-modified: Thu, 17 Oct 2019 07:18:26 GMT
server: ECS (nyb/1D2B)
x-cache: HIT
content-length: 648

Posted: **30 Jun 2022, 05:27**

however, if I have a .php file with the following, it works perfectly well :

<?php
        // Create curl resource
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "https://example.com/");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        echo $output;
        curl_close($ch);     
?>

which lets me think that MAYBE, the issue is actually your cloudflare "blocking" some of us and therefore we get the cURL error ?

Posted: **30 Jun 2022, 05:37**

hyc wrote: however, if I have a .php file with the following, it works perfectly well :

But what does it actually "output" though? It should output exactly what you see on this page https://example.com/ ...

You can try this (on our server), because it's just a TXT file. What do you see?

<?php
        // Create curl resource
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "https://www.photo.gallery/robots.txt");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($ch);
        echo $output;
        curl_close($ch);     
?>

If the above works but not ZIP, then it could be your cURL is blocking ZIP. Or maybe your cURL request is triggering a Cloudflare challenge on our side ...

Posted: **30 Jun 2022, 05:44**

my initial code outputs exactly the example.com page yes

your code with TXT file outputs "# www.robotstxt.org User-agent: * Allow: / Disallow: /app/ Disallow: /panel/ Disallow: /content*/$" while changing the file to the above zip file link outputs the following :

I tried with another zip file from another website and I see the content of the zip file (PK )...

So I think it is not on my server side..

Posted: **30 Jun 2022, 06:10**

Looks like your request has been blocked by Cloudflare "Bot fight mode". May I ask, you are in Germany?

Can you please try again, as I have temporarily disabled bot fight mode?

Posted: **30 Jun 2022, 06:21**

my server is in DE.
I am behind a VPN that points to DE but not sure if that would impact as it's my server who does the curl.
I now still see a cloudflare but a different page (and it keeps loading but nothing happens):

Posted: **30 Jun 2022, 06:49**

There is definitely something in your requests that Cloudflare doesn't like and therefore creates a challenge. First I saw your requests triggered "bot fight mode", so I disabled bot fight mode:
[IMG REMOVED]

But after that was disabled, I see your requests still cause a default Cloudflare challenge (with default Cloudflare settings). I don't know why, although the challenge-score is increased when there is missing "user agent":
[IMG REMOVED]

I have now create a firewall-rule that should bypass requests to /download/*.zip$ files. Can you check? I don't see any reason why I need security on ZIP file requests.

Posted: **30 Jun 2022, 06:57**

still the same on my side :/
mysite.com/curl.php still displays the above cloudflare page (note that the url changes to : mysite.com/download/test.zip?__cf_chl_rt_tk=RANDOMSTUFF I forgot to mention that)
and the x3_installer.php file still gives me same error as above...
and again, if in my curl.php I try with another link (example : https://www.learningcontainer.com/wp-co ... p-file.zip) it works perfectly

Posted: **30 Jun 2022, 07:10**

Ok, let's remove curl/php/server from the equation for a while, and simply load this up in browser:
https://www.photo.gallery/download/test.zip

Because as long as you are getting a Cloudflare challenge there, then you would also get the challenge in curl requests to the same URL, clearly causing an error in cURL. First I need to see why you are triggering a Cloudflare security challenge. Does it work from browser? What browser are you using? You have disabled "user agent"? At least let's get this working first. For some reason, Cloudflare does not trust your requests, and we only use default Cloudflare security settings.

Posted: **30 Jun 2022, 07:17**

i was able to download test.zip from my browser (but file is 0kb right ?)
no Cloudflare challenge from my browser (Chrome)
I don't believe I disabled user-agent (I use several extensions for privacy) but if I go here I can see good results:

https://duckduckgo.com/?q=what+is+my+us ... &ia=answer

Photo Gallery Forums

x3 installer not working

x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working

Re: x3 installer not working