Juicebox and BPS – 403 error

If the above skip/bypass does not solve the issue then you may also need to add this skip/bypass rule in your root .htaccess file, which would go directly above skip/bypass rule #12.

# Juicebox skip/bypass rule
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/wp-juicebox/ [NC]
RewriteRule . - [S=13]

Or maybe just allowing the jb-config.php file to be called remotely would take care of the issue as shown below in the Miscellaneous remote file security filter. You would need to allow the juicebox site or any additional sites remote access to this file as shown below.

# TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE
# Only Allow Internal File Requests From Your Website
# To Allow Additional Websites Access to a File Use [OR] as shown below.
# RewriteCond %{HTTP_REFERER} ^.*YourWebsite.com.* [OR]
# RewriteCond %{HTTP_REFERER} ^.*AnotherWebsite.com.*
RewriteCond %{QUERY_STRING} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
RewriteRule .* index.php [F,L]
RewriteCond %{REQUEST_URI} (jb-config\.php\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
# RewriteCond %{HTTP_REFERER} ^.*YourWebsite.com.* [OR]
# RewriteCond %{HTTP_REFERER} ^.*AnotherWebsite.com.*
RewriteRule . - [S=1]

Are you looking at the right .htaccess file?

The wp-admin .htaccess is the one you want to look at for the first fix i posted above and not your root .htaccess file.

1. Go to the BPS Edit/Upload/Download page.
2. Click on the “Your Current wp-admin htaccess File” tab.
3. Scroll down in that .htaccess file until you see this code…

And no you do not need to do anything besides just adding the .htaccess code. The change will be instantaneous.

I just looked at your pastebin code and you have added the code to your root .htaccess file so delete that code and then you want to edit your wp-admin .htaccess file and try the first fix i posted.

Also you literally copy and pasted the example i gave you. What you want to do is actually put your real information here and then you want to remove the # signs because those mean that the line of code is commented out, not in effect, not active.

# RewriteCond %{HTTP_REFERER} ^.*YourWebsite.com.* [OR]
# RewriteCond %{HTTP_REFERER} ^.*AnotherWebsite.com.*

Example:
Your actual website domain is this….

RewriteCond %{HTTP_REFERER} ^.*204eastsouth.com.*

…and then any other website domains that you want to allow to access your website files remotely you would add their domain name. When you have more than one site besides your own that you want to allow remote access to files you need to use the [OR] flag. This says allow websiteA OR websiteB OR websiteC. And the last website would not have an [OR] flag because there are no more “or” conditions since it is the last one/condition.

RewriteCond %{HTTP_REFERER} ^.*websiteA.com.* [OR]
RewriteCond %{HTTP_REFERER} ^.*websiteB.com.* [OR]
RewriteCond %{HTTP_REFERER} ^.*204eastsouth.com.*

And just an FYI for anyone who is wondering or curious about not using an [OR] flag. When you do not use [OR] then an “and” condition is implied/assumed.

Example:
conditionA “and”
conditionB “and”
conditionC “and”
…then do something here if all the conditions match…

Yep have those days too. 😉

Ok I see a mistake in the code you posted above. Add a # sign in front of the code as shown below to comment out that line of code.

...
# To Allow Additional Websites Access to a File Use [OR] as shown below.
# RewriteCond %{HTTP_REFERER} ^.*204eastsouth.com.* [OR]
...

The only code that would be modified in the wp-admin .htaccess file would be this code shown below. Even though the root and the wp-admin .htaccess files look similar they are completely different in what code you can and cannot add to them. The root .htaccess file allows you to add pretty much any .htaccess code to it that you want. The wp-admin .htaccess file is very restrictive on what code you can add to it because the /wp-admin folder is protected with authentication – your login and also you would not want to add any rewriting coding in your /wp-admin .htaccess file. 😉

# Allow wp-admin files that are called by plugins
# Fix for WP Press This
RewriteCond %{REQUEST_URI} (press-this\.php|post\.php) [NC]
RewriteRule . - [S=1]

Does Juicebox have a WordPress plugin that i can download and test?

Oh this also needs to be corrected. You have the example code commented out. You would need to actually enter real information here – the domain name that you want to allow and then uncomment that line of code by removing the # sign

# RewriteCond %{HTTP_REFERER} ^.*AnotherWebsite.com.*

Example:

RewriteCond %{HTTP_REFERER} ^.*Add-the-domain-name-for-juicebox-here.com.*

@skippy – i am having Steven look at this thread from the Juicebox Forum so this info below is for Steven to look at. Thanks.

@steven – Actually i am thinking that a better approach would be to add a Whitelist skip/bypass rule. Something like this below. What i would need to know is a constant that will not change such as an IP address to Whitelist or a URI or domain, etc. Once i have that constant or set of conditions than i can create a working Whitelist skip/bypass rule.

# Whitelist Juicebox skip/bypass
RewriteCond %{REMOTE_ADDR} ^xxx.xx.xx.xx
RewriteRule . - [S=13]

...or maybe...

# Whitelist Juicebox skip/bypass
RewriteCond %{HTTP_REFERER} ^.*juicebox.com.*
RewriteRule . - [S=13]

...or maybe using a URI condition...

@skippy – please add the working Juicebox skip/bypass rule and resolve this thread. Thanks.