Skip to content
This repository has been archived by the owner on May 14, 2020. It is now read-only.

Suppress rule 200002 when editing contacts in Nextcloud #1742

Merged
merged 1 commit into from
May 5, 2020
Merged

Suppress rule 200002 when editing contacts in Nextcloud #1742

merged 1 commit into from
May 5, 2020

Conversation

pyllyukko
Copy link
Contributor

Issue

Modifying contacts triggers an XML parsing error (rule 200002 in modsecurity.conf) which can be whitelisted in REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf.

Background

Sofware Version
CRS 3.2.0
ModSecurity 3.0.4
Nextcloud 18.0.3

Reproduction

  • Open contacts app in Nextcloud
  • Select some contact
  • Click on some contact detail (like phone number) to edit it
  • Change the value
  • "Exit" the contact detail field editing by clicking elsewhere

This will trigger a HTTP PUT request into /remote.php/dav/addressbooks/users/<username>/contacts/<some-uuid>.vcf that has Content-Type: application/xml and has the contact vCard (which of course isn't XML) in it's body.

Fix

This PR disables 200002 with PUT requests into addressbooks.

chain"
SecRule REQUEST_FILENAME "@contains /remote.php/dav/addressbooks/" \
"t:none,\
ctl:ruleRemoveById=200002"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just noticed that there should be additional newline here to end the "section" to be consistent with the rest of this file.

@franbuehler
Copy link
Contributor

In the monthly chat meeting from May 4 we decided to merge this PR:
#1749 (comment)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants