Please help us help you and fill where relevant:
Your LimeSurvey version: LimeSurvey Community Edition Version 5.2.7+211221
Own server or LimeSurvey hosting: Own server
Survey theme/template: Fruity
==================
I have a problem on limesurvey CE 5.2.7. When the admin tries to preview an uploaded file on a user response, he gets a 403: Forbidden Disable for security reasons.You do not have the permission to access this page.


It seems is a lime survey page (graphics) and not the apache page. however the access log of the apache writes:
 "GET /questionary/index.php/responses/downloadfile?surveyId=724617&responseId=6&qid=10312&index=0 HTTP/1.1" 403 8993

On another older instance of limesurvey on another linux server, the attachments are previewed ok without any problem.
I have the selinux disabled by setenforce 0.
Note than I can download all attachments of a response in a zip file, however I cannot preview each attachemt in each response.

Can you please let me know what can I try to fix this?

Thanks

On another older instance of limesurvey on another linux server, the attachments are previewed ok without any problem.
I have the selinux disabled by setenforce 0.

What the heck? I already wanted to scold you for using LS 5.2.7+211221, which is already over 2 years without updates, bug fixes and security patches and here you come along and tell us about another installation that is even older?

My first guess would be that it is an issue with the rights. Limesurvey doesn't seem to have the rights to access this folder / file. I would have a look into the permissions set for these folders.

If that isn't it, trying to fix issues/bugs on versions that are totally outdated doesn't make much sense. I would first update to the latest version of the branch and then go from there.

There are no issue with LimeSurvey here.

If you try with setenforce 0 and it work review the selinux configuration. Set the good context for the LimeSurvey upload directory.

access.redhat.com/documentation/en-us/re...ations_using-selinux

Thank you. I have already disabled selinux by "setenforce 0" on both servers the limesurvey runs (2 servers with auto sync files and with a load balancer, looking at a common database server)

I am sure there must be something prermission-related on this instance, because in a much older version of LS, the preview of the attachments works without problems.    

OK for selinux.

The upload directory have www as owner ?
What is the directory created by the webserver ?

Yes the upload has the right permissions.

drwxr-xr-x. 5 apache apache 67 Apr 3 13:10 tmp
drwxr-xr-x. 10 apache apache 177 Feb 23 11:07 upload

About the directory created, you mean the specific survey directory?
This is the upload/surveys/<surveyID>, which is the 724617

I do not know if it is related, but inside the upload directory there is the folder "surveys", which in our case points to a shared filesystem between the 2 servers. Folders and files inside this shared filesystem, have apache permissions.

I apologize for asking for help for an outdated version, but this is probably not related to any updates, since this is working on an older version.
Any help, anything to check or any idea, might be useful for me to try.
Thank you

giannopk wrote:

I do not know if it is related, but inside the upload directory there is the folder "surveys", which in our case points to a shared filesystem between the 2 servers. Folders and files inside this shared filesystem, have apache permissions.
 

It's SURELY related … you have an issue here.
Not directly linked to LimeSurvey here …
 

Yes that was the error. It related to the shortcut link. It compared the shortcut path with the real path and did not find it equal in my case (shared directory)
I edited the /application/controllers/ResponseController.php with the code from the latest version of lime survey at that point and itworked.
So problem has been fixed in the latest version of lime survey.

Thanks for your time.