2.2.x conflicts with a recommended mod_security filter: SecFilter "/lib/"

jeffreym

Joined: 2003-08-09
Posts: 10
Posted: Mon, 2007-04-09 21:47

After successfully testing 2.2.1 on one of my sandbox servers, I tested a live site and found that the update went well, however, the plugins management links to activate, deactivate, etc, were broken. The error page pointed to a mod_security problem with the /lib/ path in the links, and checking the audit_log confirmed as much.

I disabled the /lib/ filter in httpd.conf and restarted apache and the plugin management now works as advertised. Should the plugin manager be fixed to use a different path without /lib/ in it? Can't this be reworked somehow so that those recommended mod_security filters to protect against known intrusions can be left on? Or is there a better workaround for this than simply turning off filters when a script causes a conflict?

 
scaturan
scaturan's picture

Joined: 2004-09-12
Posts: 1153
Posted: Mon, 2007-04-09 22:02

that's a too broad of a ruleset and you should narrow it down. :)