Mod security resulted in 406 error

[Sudesh]

Hey guys, please bear with me as I am new to php.

I use a mod_rewrite on my website for SEF Url's. I am currently getting a 406 error on them. I emailed support and the response was:
Access denied with code 406. Pattern match "/../../ " at THE_REQUEST

From what I understand(very little), this means that my sef.php file is incorrectly coded in that I need to use the entire URL and not the shortcut.

Please advise, I have a campaign starting on Monday and all URL's that were previously indexed by search engines do not work.

Much appreciated

[thewave]

I'm having the same problem with a mambo/joomla install. Its breaking half of the SEF url's

[thewave]

Add this to your .htaccess Should fix the problem

SecFilterEngine Off

[AndrewT]

Doing that is strongly discouraged. This virtually disables much of mod_security meaning that your scripts will not be protected by it at all and there will be no tolerance given to accounts that choose to disable it and get exploited.

[thewave]

Then perhaps you could offer another solution? SMF forum seems to have similar problems with MOD_security. Can you perhaps modify the rules ?

[thewave]

Is seems mod_security also filters certain "keywords" as well.

You can see an example below

http://www.simplemachines.org/community/index.php?topic=34270.msg377287

[AndrewT]

The problem is that the /../../ string is used quite often through exploited scripts. There really isn't much reason for a production script to be using that sort of pathing instead of absolute paths.

[AndrewT]

Is seems mod_security also filters certain "keywords" as well.

You can see an example below
http://www.simplemachines.org/commun...4270.msg377287

Yes. We filter GET and POST requests.

[thewave]

On its face, this seems overly restrictive. Is there nothing that can be done to mitigate the potential risk but still allow the search engine friendly urls?

[thewave]

This is amusing. Simply entering the word curl in some contact forms or search scripts is enough to trigger mod_security.

[AndrewT]

Recent events made one thing particularly clear - we cannot depend on users to run secure and properly coded scripts. Therefore we are stuck with this solution.

Overall I've had only four or five people that have raised issues that they've had with mod_security thus far.

[thewave]

Recent events made one thing particularly clear - we cannot depend on users to run secure and properly coded scripts. Therefore we are stuck with this solution.
.

I know where this "discussion" will probably end up, but I didn't realize that users were expected to know which scripts were "properly coded". Are we expected to be PHP programmers in order to be hosted here? What makes your statement above even more amusing is the fact that "improperly coded" scripts are available via auto-installer.

Further, this module as presently configured seems to function arbitrarily.

can you explain why this url triggers mod_security, but the next doesn't?

http://www.marketinginfo.co.uk//content/view/37/28/

http://www.marketinginfo.co.uk//content/view/9/1/

[AndrewT]

I'm not asking for everyone to be experts. But far too many users just go through cPanel and install every script available with no plans to even use them let alone update them.

I was referring more specifically to the mail injection problems due to MANY people using horribly coded PHP scripts using the mail() function without first check user input for additional mail headers.

You will not have this problem if you use the script with real GET requests instead of the pathing method.

[thewave]

Further, this module as presently configured seems to function arbitrarily.

can you explain why this url triggers mod_security, but the next doesn't?

http://www.marketinginfo.co.uk//content/view/37/28/

http://www.marketinginfo.co.uk//content/view/9/1/

I'm still wondering if you can explain why the first URL above sets off mod-security, but the second does not.

[AndrewT]

I didn't write the script, I don't know how it is all handled internally. Perhaps you should ask the developers.