Trying to access my profile page returns a 403 (forbidden) error

htmltutorials

If I try to access my profile page (using this account or another account), it just shows a 403 (forbidden) error. The same with my ‘is following’ & ‘followers’ pages.

EDIT : It seems to be the same with any usernames that start with ‘html’

EDIT : It works fine if the ‘html’ letters are capital.

EDIT (again) : It seems to be something blocking any requests to anything under /html in a subfolder of the root directory (e.g. scratch.mit.edu/xxx/html but not scratch.mit.edu/html or scratch.mit.edu/xxx/xxx/html.

Last edited by htmltutorials (May 27, 2016 18:44:38)

htmltutorials

(can't seem edit the above post now…?)

It seems the problem actually affects page where there is at least one character, or just one slash, before the ‘html’. What is after the ‘html’ doesn't seem to matter.

Examples of returning 403 errors

Last edited by htmltutorials (May 27, 2016 19:09:49)

banana439monkey

I think it's because the ST stripped access off all pages containing html or something

Banana

Very inactive user who has now become a maker.
If you reply to this post it would be greatly appreciated if you could comment the link to your post on my profile!!!

TheGamer-

banana439monkey wrote:
I think it's because the ST stripped access off all pages containing html or something

Yep, it seems any url (starting scratch.mit.edu/ ) that has at least one character, and if there is a slash nothing after it, before the letters ‘html’ the server blocks it.

Last edited by TheGamer- (May 28, 2016 14:58:33)

232323.XFTQ.2011 | XqzkBEpogUjTtMDjTEyI

Bunnbuns

Wow

htmltutorials

Bunnbuns wrote:
Wow

Yep. Just hope some in the ST sees this. Not sure who to ask though

birdoftheday

It looks like all users with the text “html” in their username (and presumably all other urls with that string) return 403. Apparently the user `html' exists:

$ curl https://api.scratch.mit.edu/users/html
{"id":712621,"username":"html","history":{"joined":"2011-01-31T17:29:20.000Z"},"profile":{"id":712288,"avatar":"71/2621.png","status":"","bio":"","country":"United States"}}

But when you try to access their profile, it returns 403:

$ curl https://scratch.mit.edu/users/html
<html>
<head><title>403 Forbidden</title></head>
<body>
<h1>403 Forbidden</h1>
<ul>
<li>Code: AccessDenied</li>
<li>Message: Access Denied</li>
<li>RequestId: 9512207465947A55</li>
<li>HostId: rYsxU1EBhfnO+yeVBWT/M+QB4EbP9ImUcXA/CjwvgjE88tfgG9wKNgKu0ce2NQVAr9y9n7ZEXNw=</li>
</ul>
<hr/>
</body>
</html>

Am I the only person who likes 3.0 better than 2.0, or do the people who do just not talk about it?

htmltutorials

Bump

strager19

do you mean 404 or 403? 403 is not a thing

IgDegOo

strager19 wrote:
do you mean 404 or 403? 403 is not a thing

https://en.wikipedia.org/wiki/HTTP_403

jokebookservice1

And somebody took advantage of this and made a challenge @htmlATersHELP

Anyway, this bug is annoying

helloandgoodbye9

jokebookservice1 wrote:
And somebody took advantage of this and made a challenge @htmlATersHELP

Anyway, this bug is annoying

Not me…

Anyways, yes, please patch it.

Last edited by kaj (Tomorrow 25:61:61) ͪͪͪͪͪͪͪͪͪͪ ͣͣͣͣ ͯͯͯͯYes, its above the line)

IcyCoder

htmltutorials wrote:
If I try to access my profile page (using this account or another account), it just shows a 403 (forbidden) error. The same with my ‘is following’ & ‘followers’ pages.

EDIT : It seems to be the same with any usernames that start with ‘html’

EDIT : It works fine if the ‘html’ letters are capital.

EDIT (again) : It seems to be something blocking any requests to anything under /html in a subfolder of the root directory (e.g. scratch.mit.edu/xxx/html but not scratch.mit.edu/html or scratch.mit.edu/xxx/xxx/html.

do https://scratch.mit.edu//users/htmltutorials/

Because JS is the future (echos) future future futur futu fut fu f

Fuzzbutt

Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu/users/HTMLtutorials/

Last edited by Fuzzbutt (May 31, 2016 14:59:32)

Last edited by Kaj (Today 21:31:23)
Watch the trailer for The Mutant and follow it's official forum. The Mutant ~ Coming soon to scratch.

Paddle2See

Fuzzbutt wrote:
Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu//users/HTMLtutorials/

Nice work-around! I've put this bug into the bug-tracking system for the developers to see - but until they fix it, this could help a lot

Scratch Team Member, kayak and pickleball enthusiast, cat caregiver.

This is my forum signature! On a forum post, it is okay for Scratchers to advertise in their forum signature. The signature is the stuff that shows up below the horizontal line on the post. It will show up on every post I make.
(credit to Za-Chary)

;

htmltutorials

Fuzzbutt wrote:
Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu//users/HTMLtutorials/

Thanks for the extra slash workaround, I didn't know about that

htmltutorials

Paddle2See wrote:
Fuzzbutt wrote:
Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu//users/HTMLtutorials/
Nice work-around! I've put this bug into the bug-tracking system for the developers to see - but until they fix it, this could help a lot

Thanks for adding this into the bug tracking system. I hope this gets sorted soon though!

scratchisthebest

You can also write it with a capital letter:

https://scratch.mit.edu/users/htMltutorials/

I am a Lava Expert

Fuzzbutt

htmltutorials wrote:
Paddle2See wrote:
Fuzzbutt wrote:
Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu//users/HTMLtutorials/
Nice work-around! I've put this bug into the bug-tracking system for the developers to see - but until they fix it, this could help a lot

Thanks for adding this into the bug tracking system. I hope this gets sorted soon though!

It seems to have been fixed, because now the original link works. (So I guess my workarounds are obsolete?)

Last edited by Kaj (Today 21:31:23)
Watch the trailer for The Mutant and follow it's official forum. The Mutant ~ Coming soon to scratch.

helloandgoodbye9

TheGamer- wrote:
Fuzzbutt wrote:
htmltutorials wrote:
Paddle2See wrote:
Fuzzbutt wrote:
Found a fix for this. Instead of doing your profile page as https://scratch.mit.edu/users/htmltutorials/ , do it with two forward slashes between edu and users, like this: https://scratch.mit.edu//users/htmltutorials/ Also, if you put HTML in capitals, it works, https://scratch.mit.edu//users/HTMLtutorials/
Nice work-around! I've put this bug into the bug-tracking system for the developers to see - but until they fix it, this could help a lot

Thanks for adding this into the bug tracking system. I hope this gets sorted soon though!
It seems to have been fixed, because now the original link works. (So I guess my workarounds are obsolete?)

Yeah, it seems to be fixed now (thanks ST!)

No, it isnt obsolete. You can still use 2 slashes for the old homepage.

Last edited by kaj (Tomorrow 25:61:61) ͪͪͪͪͪͪͪͪͪͪ ͣͣͣͣ ͯͯͯͯYes, its above the line)

Discuss Scratch