[Solved] Can't Upload Images On New Server

[prestoav]

Hi there, I'm hoping someone can help here.

I've just moved a new site from my development server account over (where the site was working fine for the client to edit content pre-launch) to the client's final hosting account and the live site is all fine. However, while most edits can be done without an issue, image uploads in admin cannot. I know this has been an issue before but, having trawled the posts about it and suggested esolutions I still can't resolve it on their host.

PW Version: 3.0.123
PHP version: 7.3.20
max_execution_time 160
max_upload_size 256M
GD Library is enabled

Looking at the console data it looks like the AJAX request from the image upload is getting a 403 error which is suggesting a permissions issue? First we get this on console:
 

?id=1169&s=1&c=1:1 Uncaught SyntaxError: Unexpected token < in JSON at position 0

Then, the AJAX request:
 

https://*******/admin/page/edit/?&id=1169&InputfieldFileAjax=1

Gets a 403 according to Chrome Dev Tools > Network XHR. Also, the response is empty.

Can anyone point me in the direction of the directory that deals with this and what the permission should be to allow it or indeed any other fix / area to investigate?

Thanks so much for your help.

 

[elabx]

1 hour ago, prestoav said:

?id=1169&s=1&c=1:1 Uncaught SyntaxError: Unexpected token < in JSON at position 0

 

This has happened to me when a Warning or Error is appended for some reason on the response of the ajax upload and the icon keeps spinning. Try disabling errors and warnings through php settings. 

[prestoav]

The client's IT engineer found the issue last night. Their new live server had 'apache mod_security' enabled and that was preventing the AJAX response from getting through. As soon as it was turned off the AJAX response was received and image uploads started working.

I'd be interested to see if anyone has had this issue and if it's considered bad practice to have this turned off long-term.

[LostKobrakai]

mod_security is known do cause all manner of problems with various systems. One can get them under control, but from my experience most people just disable it.

[prestoav]

11 minutes ago, LostKobrakai said:

mod_security is known do cause all manner of problems with various systems. One can get them under control, but from my experience most people just disable it.

I figured that was most probably the situation but good to know. Thank you.

[Jonathan Lahijani]

If anyone is thinking of using MediaTemple and their latest Grid (shared) plan, please reconsider.  You will hit this issue and they will not disable mod_security.  MediaTemple is owned by GoDaddy, so you should just avoid them all together because GoDaddy is garbage in my opinion anyway.