Forums / General / modsecurity and eZ Publish

modsecurity and eZ Publish

« 
Previous topic
|
General
|
Next topic
 »
Author Message

James Ward

Tuesday 07 August 2007 10:07:35 am

Hi All,
I recently setup a new hosting server with modsecurity. I've noticed eZ Publish triggers a few security alerts and prevents user access. If anyone has a list of rules which should be excluded for eZ Publish I would love to see it. Here is what I have excluded so far:

id: 950004 msg "Cross-site Scripting (XSS) Attack. Matched signature <src=\"http:>"
id: 950006 msg "System Command Injection. Matched signature <cmd/c>"
id: 950910 msg "HTTP Response Splitting Attack. Matched signature <%0a>"

If you know of more or if you think these are not being triggered by eZ Publish please share your experience.

Cheers!

working at www.wardnet.com
blogging at www.jamesward.ca

eZ debug

Timing: Jan 18 2025 19:38:43
Script start
Timing: Jan 18 2025 19:38:43
Module start 'content'
Timing: Jan 18 2025 19:38:44
Module end 'content'
Timing: Jan 18 2025 19:38:44
Script end

Main resources:

Total runtime0.8764 sec
Peak memory usage4,096.0000 KB
Database Queries183

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0057 587.7031180.8438
Module start 'content' 0.00570.7277 768.5469467.7500
Module end 'content' 0.73340.1429 1,236.2969329.0703
Script end 0.8763  1,565.3672 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00390.4470210.0002
Check MTime0.00140.1609210.0001
Mysql Total
Database connection0.00070.076910.0007
Mysqli_queries0.823193.92141830.0045
Looping result0.00150.17101810.0000
Template Total0.852197.220.4261
Template load0.00170.198520.0009
Template processing0.850497.031820.4252
Template load and register function0.00010.014410.0001
states
state_id_array0.00080.088010.0008
state_identifier_array0.00080.089020.0004
Override
Cache load0.00140.160390.0002
Sytem overhead
Fetch class attribute can translate value0.00090.104020.0005
Fetch class attribute name0.00060.068820.0003
XML
Image XML parsing0.00070.075420.0003
class_abstraction
Instantiating content class attribute0.00000.000520.0000
General
dbfile0.00150.1676270.0001
String conversion0.00000.000730.0000
Note: percentages do not add up to 100% because some accumulators overlap

CSS/JS files loaded with "ezjscPacker" during request:

CacheTypePacklevelSourceFiles
CSS0extension/community/design/community/stylesheets/ext/jquery.autocomplete.css
extension/community_design/design/suncana/stylesheets/scrollbars.css
extension/community_design/design/suncana/stylesheets/tabs.css
extension/community_design/design/suncana/stylesheets/roadmap.css
extension/community_design/design/suncana/stylesheets/content.css
extension/community_design/design/suncana/stylesheets/star-rating.css
extension/community_design/design/suncana/stylesheets/syntax_and_custom_tags.css
extension/community_design/design/suncana/stylesheets/buttons.css
extension/community_design/design/suncana/stylesheets/tweetbox.css
extension/community_design/design/suncana/stylesheets/jquery.fancybox-1.3.4.css
extension/bcsmoothgallery/design/standard/stylesheets/magnific-popup.css
extension/sevenx/design/simple/stylesheets/star_rating.css
extension/sevenx/design/simple/stylesheets/libs/fontawesome/css/all.min.css
extension/sevenx/design/simple/stylesheets/main.v02.css
extension/sevenx/design/simple/stylesheets/main.v02.res.css
JS0extension/ezjscore/design/standard/lib/yui/3.17.2/build/yui/yui-min.js
extension/ezjscore/design/standard/javascript/jquery-3.7.0.min.js
extension/community_design/design/suncana/javascript/jquery.ui.core.min.js
extension/community_design/design/suncana/javascript/jquery.ui.widget.min.js
extension/community_design/design/suncana/javascript/jquery.easing.1.3.js
extension/community_design/design/suncana/javascript/jquery.ui.tabs.js
extension/community_design/design/suncana/javascript/jquery.hoverIntent.min.js
extension/community_design/design/suncana/javascript/jquery.popmenu.js
extension/community_design/design/suncana/javascript/jScrollPane.js
extension/community_design/design/suncana/javascript/jquery.mousewheel.js
extension/community_design/design/suncana/javascript/jquery.cycle.all.js
extension/sevenx/design/simple/javascript/jquery.scrollTo.js
extension/community_design/design/suncana/javascript/jquery.cookie.js
extension/community_design/design/suncana/javascript/ezstarrating_jquery.js
extension/community_design/design/suncana/javascript/jquery.initboxes.js
extension/community_design/design/suncana/javascript/app.js
extension/community_design/design/suncana/javascript/twitterwidget.js
extension/community_design/design/suncana/javascript/community.js
extension/community_design/design/suncana/javascript/roadmap.js
extension/community_design/design/suncana/javascript/ez.js
extension/community_design/design/suncana/javascript/ezshareevents.js
extension/sevenx/design/simple/javascript/main.js

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
1content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
1content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
1content/datatype/view/ezxmltags/line.tpl<No override>design/standard/templates/content/datatype/view/ezxmltags/line.tplEdit templateOverride template
2content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
1content/datatype/view/ezxmltags/literal.tpl<No override>extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tplEdit templateOverride template
1pagelayout.tpl<No override>extension/sevenx/design/simple/templates/pagelayout.tplEdit templateOverride template
 Number of times templates used: 8
 Number of unique templates used: 7

Time used to render debug report: 0.0002 secs