mod_security i roundcube

[mariuszad]

Witam

Mam problem z mod_security i roundcube. Chciałem dodać logo do treści pisanych maili ale żeby to zrobić muszę włączyć podpis tak aby był pisany w HTML. Nie mogę tego zrobić ponieważ mod_security mi odcina dostęp do tej funkcji:

Kod: [Zaznacz]

--a84b3d25-F--
[b]HTTP/1.1 403 Forbidden[/b]
Content-Length: 202
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--a84b3d25-E--

--a84b3d25-H--
Message: Access denied with code 403 (phase 1). Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_30_http_policy.conf"] [line "64"] [b][id "960010"][/b] [rev "2"] [msg "Request content type is not allowed by policy"] [data "application/octet-stream"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"]
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 192.168.4.11] ModSecurity: Access denied with code 403 (phase 1). Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_30_http_policy.conf"] [line "64"] [[b]id "960010"[/b]] [rev "2"] [msg "Request content type is not allowed by policy"] [data "application/octet-stream"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] [hostname "poczta.domena.tld"] [uri "/"] [unique_id "XOvOyNfi6PsNY6xc80k9RwAAAAM"]
Action: Intercepted (phase 1)
Stopwatch: 1558957768739519 768 (- - -)
Stopwatch2: 1558957768739519 768; combined=350, p1=312, p2=0, p3=0, p4=0, p5=38, sr=77, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/2.2.9.
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Engine-Mode: "ENABLED"

W apache dodałem wyjątek ale nie działa.

Kod: [Zaznacz]

<LocationMatch .*>
  <IfModule mod_security2.c>
        SecRuleRemoveById 960010
  </IfModule>
</LocationMatch>

Mój roundcube siedzi w /var/www/roundcubemail/

Czy ktoś z Was mógłby mi podpowiedzieć jak dodać tą zasadę tak aby nie blokowała działania roundcube ?

Pozdrawiam
Mariusz