php - 尝试访问 upload.php 时 plupload 运行时返回 403 FORBIDDEN 错误

Question

介绍

我正试图在一个可能很复杂的环境中实现一些相对简单的事情。我想使用 Netvibes UWA format 将文件从 JavaScript 小部件 ( plupload jQuery UI plugin ) 上传到本地 Intranet 服务器.

问题

我的代码设置似乎正确 - plupload 容器出现，我可以愉快地选择和上传文件。上传似乎有效 - 每个文件都达到 100% - 但是当我检查我的 Firebug 控制台时，我收到以下错误:

OPTIONS upload.php - 403 Forbidden

并且文件不会上传到我指定的files目录。

环境

• 源服务器是内部 IP 192.168.3.15 上的 frogserver.curriculum.local
• 收件人服务器是内部 IP 192.168.3.60 上的 staff.curriculum.local
• 原始服务器是 linux，但我无法直接访问 HTML/JS/PHP/SQL，一切都必须通过上述 Netvibes Universal Widget API 完成。这是一个封闭的虚拟学习环境解决方案，由 www.frogtrade.com 提供
• 收件人服务器是Windows/IIS

代码

JavaScript

widget.onLoad = function(){
    $( "#datetime" ).datepicker({ dateFormat: "yy-mm-dd" });
    Input.init();

    /* plupload */
    $("#uploader").plupload({
        // General settings
        runtimes : 'html5,flash,html4',
        url : 'http://staff.curriculum.local/frog/LOTS/upload.php',
        max_file_size : '1000mb',
        max_file_count: 20, // user can add no more then 20 files at a time
        chunk_size : '1mb',
        rename: true,
        multiple_queues : true,

        // Resize images on clientside if we can
        resize : {width : 320, height : 240, quality : 90},

        // Rename files by clicking on their titles
        rename: true,

        // Sort files
        sortable: true,

        // Specify what files to browse for
        filters : [
            {title : "Image files", extensions : "jpg,gif,png"},
            {title : "Zip files", extensions : "zip,avi"}
        ],

        // Flash settings
        flash_swf_url : '/user/74/186718.swf'
    });

    // Client side form validation
    $('form').submit(function(e) {
        var uploader = $('#uploader').plupload('getUploader');

        // Files in queue upload them first
        if (uploader.files.length > 0) {
            // When all files are uploaded submit form
            uploader.bind('StateChanged', function() {
                if (uploader.files.length === (uploader.total.uploaded + uploader.total.failed)) {
                    $('form')[0].submit();
                }
            });

            uploader.start();
        } else
            alert('You must at least upload one file.');

        return false;
    });
}

HTML

<form  method="post" action="../dump.php">
    <div id="uploader">
        <p>Your browser doesn't have Flash, Silverlight, Gears, BrowserPlus or HTML5 support.</p>
    </div>
</form>

PHP

我使用的 PHP 脚本是捆绑的 upload.php 文件处理脚本，在顶部添加了这段代码:

// * - stands for all domains
header("Access-Control-Allow-Origin: *");

我还更改了上传目录目标:

// Settings
//$targetDir = ini_get("upload_tmp_dir") . DIRECTORY_SEPARATOR . "plupload";
$targetDir = 'files';

想法

• 我不确定这是否属于“跨域”文件传输？我试图将其设置为好像是这样，因此我的 PHP 脚本中的 Access-Control-Allow-Origin header
• Netvibes UWA 和 VLE 设置可能会以某种方式妨碍
• Internet guest 帐户对 LOTS 文件夹的 IIS 权限似乎是正确的(即“读取”权限)，但我不完全确定；它在“特殊权限”上有“拒绝”，我似乎看不到这些权限是什么，也无法更改它

编辑:IIS 权限

刚刚检查，一切似乎都是正确的:

Answer 1

[编辑] CORS

由于权限似乎没问题，这可能是 CORS 问题。

我偶然发现了 monsur对这个问题的回答:Is it possible to use XMLHttpRequest across Domains ，引用:

A CORs request actually consists of two physical HTTP requests: 1) The preflight request, and 2) the actual request. The request you posted above looks like the preflight request, since it is uses the HTTP OPTIONS method. So the first thing you have to do is verify that your server accepts OPTIONS requests (I believe this should just work, but it may explain why you are receiving a 403).

权限

根据这个doc :

Create a separate folder for your uploaded content and change the NTFS file permissions on the upload folder

By doing this, you can configure the behavior of uploaded content differently from the rest of your Web application. Grant the upload folder Read and Write permissions for the IIS worker process identity. For IIS 6.0 in Windows Server 2003, you can use the IIS_WPG user group for this. For IIS 7.0 and later, you can use the IIS_IUSRS user group.

您可能正在检查错误用户 (IUSR_ASHVOIP) 的权限，请尝试 IIS_WPG(这似乎适合您)或 IIS_IUSRS取决于您的配置。