modsecurity and eZ Publish

« 
Previous topic
|
General
|
Next topic
 »
Author Message

James Ward

Tuesday 07 August 2007 10:07:35 am

Hi All,
I recently setup a new hosting server with modsecurity. I've noticed eZ Publish triggers a few security alerts and prevents user access. If anyone has a list of rules which should be excluded for eZ Publish I would love to see it. Here is what I have excluded so far:

id: 950004 msg "Cross-site Scripting (XSS) Attack. Matched signature <src=\"http:>"
id: 950006 msg "System Command Injection. Matched signature <cmd/c>"
id: 950910 msg "HTTP Response Splitting Attack. Matched signature <%0a>"

If you know of more or if you think these are not being triggered by eZ Publish please share your experience.

Cheers!

working at www.wardnet.com
blogging at www.jamesward.ca
Powered by eZ Publish™ CMS Open Source Web Content Management. Copyright © 1999-2014 eZ Systems AS (except where otherwise noted). All rights reserved.

eZ debug

Timing: Jan 18 2025 18:41:18
Script start
Timing: Jan 18 2025 18:41:18
Module start 'layout'
Timing: Jan 18 2025 18:41:18
Module start 'content'
Timing: Jan 18 2025 18:41:19
Module end 'content'
Timing: Jan 18 2025 18:41:19
Script end

Main resources:

Total runtime0.5219 sec
Peak memory usage4,096.0000 KB
Database Queries46

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0069 587.9063152.6250
Module start 'layout' 0.00690.0039 740.531339.4453
Module start 'content' 0.01090.5097 779.9766462.6719
Module end 'content' 0.52060.0013 1,242.64848.1641
Script end 0.5219  1,250.8125 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00320.6085160.0002
Check MTime0.00130.2572160.0001
Mysql Total
Database connection0.00140.273810.0014
Mysqli_queries0.483192.5728460.0105
Looping result0.00040.0751440.0000
Template Total0.490894.020.2454
Template load0.00220.416820.0011
Template processing0.488693.626820.2443
Template load and register function0.00010.015510.0001
states
state_id_array0.00120.225910.0012
state_identifier_array0.00070.138920.0004
Override
Cache load0.00170.329790.0002
Sytem overhead
Fetch class attribute can translate value0.00050.089910.0005
Fetch class attribute name0.00050.105020.0003
XML
Image XML parsing0.00030.060010.0003
class_abstraction
Instantiating content class attribute0.00000.000820.0000
General
dbfile0.00060.1160160.0000
String conversion0.00000.001940.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
1content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
1content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
1content/datatype/view/ezxmltags/line.tpl<No override>design/standard/templates/content/datatype/view/ezxmltags/line.tplEdit templateOverride template
2content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
1content/datatype/view/ezxmltags/literal.tpl<No override>extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tplEdit templateOverride template
1print_pagelayout.tpl<No override>extension/community/design/community/templates/print_pagelayout.tplEdit templateOverride template
 Number of times templates used: 8
 Number of unique templates used: 7

Time used to render debug report: 0.0001 secs