Unable to Update Configuration Settings – 403 Forbidden in Bagisto 2.4

gkdev

Hi Bagisto Team,

Yesterday, I was trying to update the Payment Method settings from the Configuration section in Bagisto, but I was continuously getting a 403 Forbidden error whenever I tried to save the changes.

At that time, a support member suggested that I update my Bagisto installation from the master branch to the latest 2.4 branch.

I updated my installation to the latest 2.4 version, and the Payment Method error no longer occurs. However, I am still facing the same 403 Forbidden error in other modules under the Configuration section.

It seems that the issue is not limited to the Payment Method configuration and may be related to the configuration save/update functionality or permissions.

Could someone please guide me on:

What could be causing the 403 Forbidden error across the Configuration modules?
Is there any additional migration, permission, cache, or configuration change required after updating from the master branch to 2.4?
Is there any recommended way to properly update/sync the latest 2.4 branch in an existing Bagisto installation?
Are there any specific routes, middleware, CSRF, ACL/permission, or server configuration settings I should check?

Current situation:

Previous version: Master branch
Updated version: Latest 2.4 branch
Payment Method: Working after the update
Other Configuration modules: Still returning 403 Forbidden

Any guidance on how to properly resolve this issue would be greatly appreciated.

Thank you.

gkdev

https://forums.bagisto.com/post-queue/topic-1788940219054

admin

Hi @gkdev ,

Thanks for the clear details. A 403 Forbidden while saving Configuration is
usually caused by one of the three things below. Please check them in this order.

Server security rule (the most common cause)
Most servers run a security firewall (like ModSecurity / WAF). It can block a
"Save" when one of the setting fields contains characters it treats as unsafe -
for example < > quotes, a URL, or code-like text. This is why some Configuration
pages save fine and others give a 403.

Ask your hosting/server team to open the web server error log (Apache or
Nginx) at the exact time you got the 403.
If a security rule is blocking it, ask them to allow/whitelist your admin
save URL: /admin/configuration.

Tip to confirm this: a plain white "403 Forbidden" page means the server blocked
it. A Bagisto permission problem instead shows the styled Bagisto "Unauthorized"
screen, and a CSRF problem shows a "419" page - so those two are likely not your
issue here.

Admin role permissions
After moving to 2.4, an existing role can be left without full rights.

Go to Settings > Users > Roles, open your role, set Access Control to "All",
and save it.
Log out, log back in, and try saving again.

Old cache left over from the update
After any version update, run the migrations and clear all caches:
php artisan migrate
php artisan optimize:clear
php artisan route:clear
php artisan config:clear
php artisan view:clear

Recommended way to update master -> 2.4 in an existing install:

Take a full backup first (both files and database).
Pull the 2.4 code.
Run: composer install
Run the migrate + cache-clear commands listed above.
Rebuild the admin assets if needed:
cd packages/Webkul/Admin
npm install && npm run build

If you can share that one error-log line from a failed save, we can tell you
exactly which rule is blocking it.

Thanks.
Aviral
Bagisto Team

gkdev

HI Aviral
i'm try but not show any error.
notice one point. whenever select any upload image then give me this 403