Litespeed 403 POST数据问题(mod_security未解决)可能是由于方括号[]输入名称引起的



所以我有一个在PHP5上运行的定制PHP站点,我正试图从Apache迁移到另一家托管公司上的另一台Litespeed服务器(我假设是开源Litespeed(

/foo/bar.php本身运行良好

但是,当使用/foo/index.html将POST数据发送到/foo/bar.php时,我得到一条403错误消息

我希望添加mod_security更改会起作用,但我认为没有。也许我没有正确地将其添加到.htaccess中这是可能的,但不太可能,因为.htaccess的其他部分(如果没有要求,则重写以查找.php文件(工作正常

<IfModule mod_security.c>
SecFilterScanPOST Off
</IfModule>

这是一个示例POST";有效载荷":

filename=000000B--ANOTHER-TEST.txt&sectionlabels%5B%5D=DEFAULT_METADATA&sections%5B%5D=album%3A+TEST%0D%0Aartist%3A+TEST%0D%0Aalbum_artist%3A+TEST%0D%0A%0D%0A%3B+set+the+default+composer%0D%0Acomposer%3A+TEST%0D%0A%0D%0Agenre%3A+Classical%0D%0A%0D%0Ayear%3A+1999%0D%0A%0D%0A%3B+used+for+the+comment+metadata%0D%0Avenue%3A+_REPLACE_THIS_%0D%0Aconcertdate%3A+November+30th%2C+1999%0D%0Aengineer%3A+Adam+Borecki+-+adamborecki.com%0D%0Acomments%3A+Recorded+Live%0D%0A%0D%0A&sectionlabels%5B%5D=PIECES&sections%5B%5D=A+_REPLACE_THIS_%0D%0A%0D%0A01+Title%0D%0Acomposer%3A%0D%0Aartist%3A%0D%0A01a+I.%0D%0A01b+II.%0D%0A%3B+etc.%0D%0A%0D%0A%3Bintermission%0D%0A%0D%0A&sectionlabels%5B%5D=EMAILS&sections%5B%5D=recording%40adamborecki.com%0D%0A_REPLACE_THIS_%0D%0A%0D%0A&sectionlabels%5B%5D=B2BUCKET&sections%5B%5D=-Borecki-RecordingLA-2018a-%0D%0A%0D%0A&sectionlabels%5B%5D=NOTES&sections%5B%5D=%3C%21--+The+photos+from+your+recording+are+ready%21+Note+that+the+audio+and+video+files+should+be+ready+soon+but+will+take+a+little+bit+longer.+If+you+need+them+for+a+specific+deadline%2C+please+be+sure+to+contact+Adam+right+away.+--%3E%0D%0A%0D%0A%3C%21--+Remember+to+get+obtain+permission+from+performers+and+composers+before+posting+to+the+internet.+--%3E%0D%0A%0D%0A%0D%0A&sectionlabels%5B%5D=SETTINGS&sections%5B%5D=PIECE_FILENAME%3A+%25title%25+-+%25composer%25%0D%0AMVT_FILENAME%3A+%25title%25+-+%25mvt_title%25+-+%25composer%25%0D%0AMVT_TITLE%3A+%25mvt_title%25+-+%25title%25+-+%25composer%25%0D%0A%0D%0A%3B+turn+on+track+numbers+metadata+%28primarily+for+audio%29%0D%0A%3B+leave+ON+for+recitals%0D%0ATRACK_NUMBERS%3A+true%0D%0A%0D%0A%3B+recommended%3A+FALSE+-+every+clip+from+FCPXML+should+be+named+in+the+cuesheet.%0D%0AALLOW_UNMATCHED_CLIPS%3A+false%0D%0A%0D%0A&sectionlabels%5B%5D=OUTPUTS&sections%5B%5D=%5BDEFAULT_MP4_OUTPUT%5D%0D%0A%5BDEFAULT_WAV_OUTPUT%5D%0D%0A%5BDEFAULT_MP3_OUTPUT%5D%0D%0A%0D%0A%3B.mp4+Video+%28HD+1080p%29%2F%0D%0A%3B%09VFADEOUT%3D1.2%0D%0A%3B%09VFADEIN%3D1%0D%0A%3B%09AFADEOUT%3D.2%0D%0A%3B%09-c%3Av+libx264%0D%0A%3B%09-profile%3Av+high%0D%0A%3B%09-crf+23%0D%0A%3B%09-preset+fast%0D%0A%3B%09-tune+film%0D%0A%3B%09-c%3Aa+libfdk_aac%0D%0A%3B%09-pix_fmt+yuv420p%0D%0A%3B%09-b%3Aa+192k%0D%0A%3B%09-ar+48000%0D%0A%0D%0A

这是我的.htaccess文件:

Options +FollowSymlinks -MultiViews
RewriteEngine on
# RewriteBase /
# remove trailing slash if its there -- THIS is some super old code, I just leave it in
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.*)?/$ //%{HTTP_HOST}/$1 [L,R=301,QSA]
# interal add php if it isnt there-- THIS is also some super old code, I just leave it in
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.*)?$ $1.php [L,QSA]

# from https://stackoverflow.com/questions/23736913/php-form-post-redirects-to-403-error-page-by-litespeed-web-server
# it looks like I need to turn OFF a security setting on LiteSpeed so that it'll allow post data
<IfModule mod_security.c>
SecFilterScanPOST Off
</IfModule>


# I THINK THE STUFF BELOW is from an older cPanel host. I'm migrating to a new one, and I'm doing that via tar.gz compression of the old files and moving over to new server and then unzipping

# BEGIN cPanel-generated ph

p ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php5_module>
php_flag asp_tags Off
php_flag display_errors On
php_value max_execution_time 30
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 128M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php56"
php_value upload_max_filesize 50M
</IfModule>
# END cPanel-generated php ini directives, do not edit

应该使用SecRuleEngine off而不是SecFilterScanPOST Off

最新更新