Admin Cannot Create New Users

[nootkan]

I am running version 1.6.16 and everything seems to be fine except I cannot create a new user without doing so inside my database with phpmyadmin.  When I try to create the new user inside cpg admin and hit save I get a 404 page cannot be found error.  I viewed my cpg security logs and here is what I see:

Dec 30, 2021 at 10:03 PM - Denied privileged access to usermgr.php by user Guest at IP xxxxxx
Dec 30, 2021 at 10:12 PM - Denied privileged access to catmgr.php by user Guest at IP xxxxxx
Dec 30, 2021 at 10:18 PM - Denied privileged access to profile.php by user Guest at IP xxxxxx

The ip address is mine so not sure why it is saying I'm a guest when I am logged in as admin.

Anyone else have this problem before? I tried searching the forums but nothing came up.

[ron4mac]

You need to be consistent with whether the site is being accessed as http: or https:
Make sure the site url in the config starts with https:
Also consistent use of www. or not.

[I see you found Monica's themes ... good job]

[nootkan]

Hi thanks for the reply.  I'm not sure I understand you correctly.  When I view my general settings I see this:

URL of your Coppermine gallery folder (with a trailing slash, no 'index.php' or similar at the end) https://www.grstreamkeepers.com/photogallery/        
URL of your home page    https://www.grstreamkeepers.com/photogallery/index.php

I tried changing the home page url to just index.php but that didn't work either.  I also tried changing back to the Curve theme to see if it was a theme issue but got the same result.

[nootkan]

I tried logging in with one of the users credentials and everything works fine for him when editing his profile.  Just cannot add a new user or edit a users profile in admin.

[ron4mac]

If you PM me with an admin login, I'll see if I can resolve the issue.

[ron4mac]

I feel that what I am seeing is being caused by some site or WP .htaccess rule

[nootkan]

Hmmm...Okay I figured it out.  It was a rule in modsecurity that was blocking what it thought was a blind sql injections.  I whitelisted the rule for the domain and it works.  I also seen your attemp which was blocked also before I made the change.  Thanks for your help.