Wow, I hadn’t thought of this server setup.
I think you may be able to setup the waf using the constants.
Set _WAF_CLIENT_IP_HEADER to REMOTE_ADDR. In mes_options.php
Also, add your own IP to the IP’s allowed / allowlisted:
Please let me know if this works already!
For now, the WAF config form blocks setting of headers that resolve to local IPs, to prevent misconfiguration.
But you should be able to set it via mes_options.php.
It would then in any case block access from external visitors (as long as their external IP is reflected in the header you selected (REMOTE_ADDR)).
You can e.g. test this by connecting through the phone network, and visit monsite.net/?system(reboot) which will be blocked if active or reach the homepage if the WAF is not active.
Thanx. I obtain a 404 error and WAF seems to run.
Regards,
Odile.
Hi @ursrig , I am wondering about something.
Let’s assume I have a technical security blog and I want to write an article about how to use directory traversal to display a passwd file. If I write something like this in my article:
Would my edit then be blocked by WAF?
Yes, but that’s why there is an option on the confirm for to disable the WAF for logged in users (editeurs and administrators).
Hi @ursrig,
I’ve come across a problem on an English-language website where the text is correct.
PATTERN_MATCH :
pattern=/\b(?:or|and)\b\s+['"][^'"\s]{0,32}['"][\s=<>!]/i, desc=OR/AND injection, matched_value=chosen and Abraham's children through Ishmael.
Shouldn’t the rule be adjusted?
Bonne nouvelle :
La documentation en français est publiée:
@Christophe_Gindro, oui, la règle est effectivement trop agressive.
Pour résoudre immédiatement :
Désactiver les règles pour les utilisateurs connectés:
→ Dans le formulaire de configuration, il existe une option intitulée « Disable WAF rules for logged‑in users (editors, administrators) ».
Cela permet de travailler normalement sans blocages.
ET: J’ai également retiré cette règle du plugin. La mise à jour sera disponible dans quelques heures. Une fois que vous aurez installé la prochaine version de SPIP WAF (v1.2.19), vous pourrez décocher cette option dans le formulaire de configuration, car la règle n’existera plus.
Merci pour vos retours !
Urs
Merci pour la réactivité.