Mod_Security help please - Joomla! Forum - community, help and support

in install extensions unable click on components | modules | plugins | languages | templates links. when did, got error:

code: select all

forbidden

you don't have permission access /administrator/index.php on server.

additionally, 404 not found error encountered while trying use errordocument handle request.

so did bit of searching , found if turned off mod_security adding following code .htaccess file in joomla root worked.

code: select all

#disable mod security
#secfilterengine off
secfilterscanpost off

my questions are
1. why need turn off/why doesnt work on?
2. security risk turning off.

i on j1.5.10, php version: 5.2.8, database version: 4.1.22-standard

i have read info on mod_security still dont understand it.

mod_security apache webserver module, (it nothing directly joomla!) used filter potentially dangerous requests sites. therefore, removing or modifying rules configured in mod_security has potential explose site in cases.

more information can found @ http://www.askapache.com/htaccess/mod_s ... ricks.html or search web mod_security , find many many references.

mod_security maybe manipulated within .htaccess file if host allows it, examples shown below;
the example lines in bold canbe used, if allowed, temporarily turn off mod_security finctionality on site testing purposes, check if fixes issue.


# turn filtering engine on or off or dynamiconly cgi/php/etc
secfilterengine off

# log suspicious requests
secauditengine relevantonly

# goes 9 @ 2 overwhelming trust me
secfilterdebuglevel 0

# make sure url encoding valid
secfiltercheckurlencoding on

# unicode encoding check
secfiltercheckunicodeencoding off

# should mod_security inspect post payloads
secfilterscanpost on

# default rule apply inherited rules
secfilterdefaultaction "deny,log,status:500"

most host has either increased mod_security filters or installed th ebasic filters not take in account php, need tal host regarding filters settings.

in many respects, turning off mod_security reduces site protection , increases potential risk of compromise, in general better have mod_secuirty running.