compatibility with mod_security
Submitted by dydimustk on Sat, 03/15/2008 - 16:36.
| Project: | ProjectPier |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | new |
Jump to:
Description
A number of actions in projectpier utilize a url based function that is highly suspicious of hacking and injection, to the point that most mod_security installations will block the action rather than allowing it to execute. projectpier should take this into consideration since (a) more and more users will run into this issue as more hosts install mod_security to protect themselves and other customers.
For example, the url:
http://projects.ekklesialab.com/index.php?c=account&a=edit_avatar&id=1&redirect_to=http%3A...
triggers this error:
406 Not Acceptable
This request was blocked by mod_security.
Access denied with code 406. Pattern match "\\.php\\?.*=(http|https|ftp)\\:/.*\\?" at REQUEST_URI [severity "EMERGENCY"]
Opps, meant normal
I think this is unavoidable because of the nature of dynamic web applications - you have to be able to pass arguments through the url.
If I'm missing something, please suggest a fix.
We could possibly get around it by base64_encoding it.
Maybe there is not need to include ROOT_URL and this can be added at time of executing redirect?
http://projects.ekklesialab.com/index.php?c=account&a=edit_avatar&id=1&redirect_to=c%3Dacc...
Is there ever a need to redirect offsite?