[pmwiki-users] Problem editing pages -- mod_security the cause?

Christian Ridderström christian.ridderstrom at gmail.com
Wed Mar 25 18:29:30 CDT 2009


I've move the LyX wiki to a new site and encountered something I haven't 
seen before. Basically I can click the edit link and be shown the web page 
with the edit form, but when I press SAVE, I get an error 400.

Here's what I found in the error log:

[Thu Mar 26 00:18:34 2009] [error] [client] ModSecurity: 
Access denied with code 400 (phase 2). Pattern match
"\\\\%(?!$|\\\\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" at ARGS:text. [id 
"950107"] [msg "URL Encoding Abuse Attack Attempt"] [severity "WARNING"] 
[hostname "wiki.lyx.org"]
[uri "/LyX/LyxFunctions?action=edit"] [unique_id 

So it seems that ModSecurity might be stopping it... but its strange to 
me, especially as the first request that generates the web page with the 
edit form looks the same, i.e.

The difference between the two requests could be that first one is a GET, 
whereas the second one is a POST.

Then there is something else that's also strange... the web site was also 
relocated to the same server, and that site is really a pmwiki site in 
disquise, and on the web site the editsing works!

Any ideas on how to solve this, or to troubleshoot it further?


Christian Ridderström				Mobile: +46-70 687 39 44

More information about the pmwiki-users mailing list