Main   Changelog   Spec   Patches   Sources   Download   Gear   Bugs and FR  Repocop 

# Some ALT specific rules
#
# ModSecurity Core Rules is installed into
# rules/ directory 
#
# Place local rules into local_rules/ directory
#
#
# For additional resources see README.ALT
#

# Ignore static content
SecRule REQUEST_METHOD "^(GET|HEAD)$" \
    "id:99990,phase:1,allow,nolog,chain"
SecRule REQUEST_BASENAME "\.(jpg|gif|png)$" chain
SecRule &ARGS "@eq 0"


# phpbb2 (and friends?) remote code exec
# (Rule 310080 from http://www.gotroot.com/mod_security+rules)
SecRule ARGS:highlight "(?:\x27|%27|\x2527|%2527)" \
    "id:99991,phase:2,deny,log,status:403,msg:'JITP: PHPBB worm'"


# WEB-PHP squirrelmail theme arbitrary command attempt
# (Rule 310009 from http://www.gotroot.com/mod_security+rules)
SecRule REQUEST_URI "/left_main\.php" \
    "id:99992,phase:2,deny,log,status:403,msg:'JITP: squirrel mail theme arbitrary command attempt',chain"
SecRule REQUEST_URI "cmdd="