images uploaded blocked by modsecurity about berta HOT 2 CLOSED

Disable protection in the /engine directory by adding the .htaccess file with the following configuration:

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

/engine part is accessible after authorisation so it should be safe.

from berta.

Thanks for your quick answer.
I don't think to deactivate modsecurity completely on a folder, even if it's a folder accessed after authentication, is a good idea (very bad from my point of view).

I added a rule more specific to this problem and will see if no other problems appear.
I put it here in case someone else is in the same situation:

SecRule REQUEST_HEADERS:Host "^(www\.)?xxxx.net$" "phase:1,t:none,nolog,chain,pass,setvar:tx.score=1"
  SecRule REQUEST_METHOD "^POST$" "t:none,chain,setvar:tx.score=+1"
  SecRule REQUEST_FILENAME "engine/upload.php" "t:none,chain,setvar:tx.score=+1"
  SecRule TX:SCORE "@eq 3" "ctl:ruleRemoveById=960015"

I wish you the best with your cms. It looks very nice.

from berta.