Skip to content

modsecurity cause image upload failed #957

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
cloudproxys opened this issue Nov 5, 2015 · 6 comments
Closed

modsecurity cause image upload failed #957

cloudproxys opened this issue Nov 5, 2015 · 6 comments

Comments

@cloudproxys
Copy link

After you install nginx mod_security module first discovered the problem, you can not post the data, I will port to the non-80 port, the problem is solved, then found the problem 2, you can not upload pictures, debug display without any exception, is there anyone encountered this situation should be how to solve
@csanders-git
Copy link

could you include the debug message perhaps?

@cloudproxys
Copy link
Author

[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Initialising transaction (txid AcAcpc9cAcbcAcAMAcAcA5Ac).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adksh", value "1446688266219"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adkse", value "1802636bb006633554ef745b4fe8d1ab"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adksd", value "direct"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adksf", value "%26_u%3D0%26_a%3D0%26_k%3D0%26_s%3D0"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "route", value "eb491f23fac9dd23fb886ce9f60af6a2"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adksc", value "1446691557852"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "_adksa", value "130025103.214741544.1446688266241.1446691408598.1446691557872"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "OW_RememberMe", value "houaiguo"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "sid", value "c97719e2-469d-41b9-8412-8f7fe0630167"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "logininfo", value "pGM72YxKGoFDlE6j/GYkCctt4vMZbrm9q2+PxiJQGEG+fTSNygrN/zhiyZ8VQ671vg+kvMgm2h1h4pKKe2endyTVN0BDsvspEgorgZ7Q36pzSCVAzTKcGr2zKtmXJUxczGGwQZjZmnLXVHzJUhOeDHHWwqLtPrfkadZqq02mPvtNOaXzZEWPfz/7iMy7Ceyg/ca6HB3JqtZdPAk+RFG87PkpBja2O1MZJgJP6ABJkUnqgmdr84djKTEzJ82X1JK/Qc0ss1kZy90MEKUm49ZNOd1qkFH9EUHYvePr8wjwaOQoQKp3kHYcUYSf48JIj5kZ9PfvLHK2jD2L4wFf4Kh5kmIupNZHTb6wQ+ybGCEbzOw2AVQm0ljPFf4OKKnpF2LmafF9Yrl15+q/2Iuy9SV6Qzfk140sK6BBToumn+aWgHFchr6QLvNF5noTvVH/nAXzFBqDfmGG+EVcnB+ftLyNnjHxxjSBBQiE1GGjj/BdRh5qhpF6MazZo5O38KCn+gCWsIcO9J655Dugd/B+oBPcBhkb2Usz0HUVad1u4V4yZmidt3aH9kHJ6FslIPM1haEoCcdHlZ2G6MfvyerzHddiZzxfxfefTCZ5816BWKTf/nBbTx34kxLcBjiQzsfnUEstEuCjQYuo0l9zO1Yb11pjEqwBQvASBrymExkRukQ0UeY4W9IZsqGwG+GnceDdBy3Y"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "loginSessionID", value "c97719e2-469d-41b9-8412-8f7fe0630167"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "RequestVerificationToken_Lw", value "hVTyq8GcQy70CDNfQ22SI/44tEOLchf3HG6nNCx0jVKnsYD/UvPQ3/uz5fo6Hgy6J0IuPRZQrRPefwYhl97A2tevDVkJSC4JLiM53ayF5JinB0Hjmdx9SdrJimto/y8GsCGjAVp7PCNyVbTLYxioguRNCtQwZ1+dmxZRrOmM40o="
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "LoginValidCode", value "141J"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "Hm_lvt_c8752f1ed50be0798e275b8114081c89", value "1446688266,1446690626,1446691558"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "Hm_lpvt_c8752f1ed50be0798e275b8114081c89", value "1446691572"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "Hm_lvt_11a0d0462736ffe428c2decbb869ef07", value "1446688266,1446690626,1446691558"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "Hm_lpvt_11a0d0462736ffe428c2decbb869ef07", value "1446691572"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request cookie: name "adksb", value "1446693372194"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transaction context created (dcfg 13e8980).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Starting phase REQUEST_HEADERS.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] This phase consists of 2 rule(s).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1414730; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "23"] [id "200000"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1414730: SecRule "REQUEST_HEADERS:Content-Type" "@rx text/xml" "phase:1,auditlog,id:200000,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] T (0) lowercase: "multipart/form-data; boundary=----webkitformboundaryk9ay5pmc0gnml326"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transformation completed in 127 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Executing operator "rx" with param "text/xml" against REQUEST_HEADERS:Content-Type.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Target value: "multipart/form-data; boundary=----webkitformboundaryk9ay5pmc0gnml326"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Operator completed in 7 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1412428; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "30"] [id "200001"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1412428: SecRule "REQUEST_HEADERS:Content-Type" "@rx application/json" "phase:1,auditlog,id:200001,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] T (0) lowercase: "multipart/form-data; boundary=----webkitformboundaryk9ay5pmc0gnml326"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transformation completed in 43 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Executing operator "rx" with param "application/json" against REQUEST_HEADERS:Content-Type.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Target value: "multipart/form-data; boundary=----webkitformboundaryk9ay5pmc0gnml326"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Operator completed in 5 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Second phase starting (dcfg 13e8980).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Input filter: Reading request body.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Boundary: ----WebKitFormBoundaryk9Ay5pmc0Gnml326
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Input filter: Bucket type NGINX contains 8192 bytes.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part header "Content-Disposition" "form-data; name="CurrentSessionId""
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Content-Disposition name: CurrentSessionId
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added data to variable: c97719e2-469d-41b9-8412-8f7fe0630167
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part 1dc9830 to the list: name "CurrentSessionId" (offset 101, length 36)
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part header "Content-Disposition" "form-data; name="__RequestVerificationToken""
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Content-Disposition name: __RequestVerificationToken
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added data to variable: Ve4iVejvfoVrB/ZuMWkT4bSUxc5qQ8rPoRaIKDyV2f2lyEG5s3uKuhG4mJ2riwbIad0XzueSyNj2mD3uO1iJ/B7k6bK+kqsq5oE9nScthm055y0mWxFDiehrQ5c218K/U+YiZ2Z2GjGLIa03pDdMzPQjWrTyEQQ5ebnLWNOjNCtizgDlqIFi4ysTVtnPvG+G
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part 1dd1f70 to the list: name "__RequestVerificationToken" (offset 250, length 192)
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part header "Content-Disposition" "form-data; name="memberCode""
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Content-Disposition name: memberCode
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added data to variable: US000799
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part 1e1cbd0 to the list: name "memberCode" (offset 539, length 8)
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part header "Content-Disposition" "form-data; name="FileUploadImg"; filename="1.png""
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added part header "Content-Type" "image/png"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Content-Disposition name: FileUploadImg
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Content-Disposition filename: 1.png
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Input filter: Bucket type NGINX contains 8192 bytes.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Input filter: Bucket type NGINX contains 1155 bytes.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Multipart: Added file part 1e1d290 to the list: name "FileUploadImg" file name "1.png" (offset 690, length 16803)
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Input filter: Bucket type EOS contains 0 bytes.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request argument (BODY): name "CurrentSessionId", value "c97719e2-469d-41b9-8412-8f7fe0630167"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request argument (BODY): name "_RequestVerificationToken", value "Ve4iVejvfoVrB/ZuMWkT4bSUxc5qQ8rPoRaIKDyV2f2lyEG5s3uKuhG4mJ2riwbIad0XzueSyNj2mD3uO1iJ/B7k6bK+kqsq5oE9nScthm055y0mWxFDiehrQ5c218K/U+YiZ2Z2GjGLIa03pDdMzPQjWrTyEQQ5ebnLWNOjNCtizgDlqIFi4ysTVtnPvG+G"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Adding request argument (BODY): name "memberCode", value "US000799"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Request body no files length: 516
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Input filter: Completed receiving request body (length 17539).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Starting phase REQUEST_BODY.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] This phase consists of 7 rule(s).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1418448; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "81"] [id "200003"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1418448: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,id:200003,t:none,log,deny,status:400,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_MISSING_SEMICOLON}, IQ %{MULTIPART_INVALID_QUOTING}, IP %{MULTIPART_INVALID_PART}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transformation completed in 2 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Target value: "0"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Operator completed in 7 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1417150; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "86"] [id "200004"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1417150: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,id:200004,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transformation completed in 1 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Target value: "0"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Operator completed in 4 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1420b58; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "100"] [id "200005"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1420b58: SecRule "TX:/^MSC/" "!@Streq 0" "phase:2,log,auditlog,id:200005,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 141f160; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "231"] [id "91002"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 141f160: SecRule "ARGS:" "!@rx \d{13}" "phase:2,auditlog,id:91002,t:none,log,drop"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, not chained -> mode NEXT_RULE.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recipe: Invoking rule 1472778; [file "/usr/local/nginx/conf/modsecurity_www.conf"] [line "236"] [id "91003"].
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][5] Rule 1472778: SecRule "REQUEST_HEADERS:User-Agent" "@rx ^(Mozilla/4.0)\s((compatible;)\s(MSIE)\s(6.0;)\s(Windows)\s(NT)\s(5.0))$" "phase:2,auditlog,id:91003,t:none,log,deny,status:400,msg:'no access',chain"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Transformation completed in 1 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Executing operator "rx" with param "^(Mozilla/4.0)\s((compatible;)\s(MSIE)\s(6.0;)\s(Windows)\s(NT)\s(5.0))$" against REQUEST_HEADERS:User-Agent.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] Target value: "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][6] Ignoring regex captures since "capture" action is not enabled.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Operator completed in 84 usec.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Rule returned 0.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] No match, chained -> mode NEXT_CHAIN.
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Hook insert_filter: Adding input forwarding filter (r 1d340a8).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Hook insert_filter: Adding output filter (r 1d340a8).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Input filter: Forwarding input: mode=0, block=0, nbytes=-1 (f 1d354b8, r 1d340a8).
[05/Nov/2015:10:45:33 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Input filter: Forwarded 8192 bytes.
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Initialising logging.
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Starting phase LOGGING.
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][9] This phase consists of 0 rule(s).
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Recording persistent data took 0 microseconds.
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Audit log: Ignoring a non-relevant request.
[05/Nov/2015:10:45:36 +0800] [/sid#13e80a8][rid#1d340a8][/usermain/WebUploadImg][4] Multipart: Cleanup started (remove files 1).

@csanders-git
Copy link

I see no blocking here, i'm not sure what you were referring to... possibly you are confused about (remove files 1)... this is there to delete temporary files that are stored by modsec. Your configuration can also alternatively save them... see (https://books.google.com/books?id=HnQl5OVtOYgC&pg=PA15&lpg=PA15&dq=Multipart:+Cleanup+started+(&source=bl&ots=0EonWgxdQk&sig=2m9ToeeQuUkPRdeU7yWsS0PC_DM&hl=en&sa=X&ved=0CB4Q6AEwAGoVChMInN-H5KX4yAIVBZQeCh28DQV9#v=onepage&q=Multipart%3A%20Cleanup%20started%20(&f=false)

@cloudproxys
Copy link
Author

debug logs show no abnormalities, before interception post data is not displayed in the debug log, so I suspect can not upload photos is not also a bug ah

@csanders-git
Copy link

i'm not quite sure what that means sorry, can you restate it somehow?

@zimmerle
Copy link
Contributor

zimmerle commented Nov 9, 2015

Please check #959

@zimmerle zimmerle closed this as completed Nov 9, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zimmerle @csanders-git @cloudproxys