| The Following User Says Thank You to aegis For This Useful Post: | ||
| The Following 15 Users Say Thank You to szopin For This Useful Post: | ||
# calDAV / cardDAV / webDAV use PROPFIND, REPORT, PUT and MKCOL # change allowed methods for ownCloud to avoid false positive with 960032 # in crs_30_http_policy. list of allowed methods is set in file # modsecurity_crs_10_setup.conf, rule id:'900012' # add "application/octet-stream" to allowed_request_content_type for ownCloud # file uploads, and "text/calendar" for caldav SecRule REQUEST_URI "@beginsWith /owncloud/remote.php" \ "id:'000002', \ phase:1, \ t:none, \ setvar:'tx.allowed_methods=GET HEAD POST OPTIONS PROPFIND REPORT PUT MKCOL', \ setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/ form-data|text/xml|application/xml|application/x-amf|application/json|application/octe t-stream|text/calendar', \ nolog, \ pass"
# turn on the XML processor for webdav, caldav and carddav requests SecRule REQUEST_URI "@rx ^/owncloud/remote.php/(webdav|caldav|carddav)" \ "chain,id:'000090',phase:1,t:none,t:lowercase,pass,nolog" SecRule REQUEST_METHOD "@rx (PROPFIND|REPORT)" \ "ctl:requestBodyProcessor=XML"