Hi,
I wanted to bring to your attention a recent issue that many users have been experiencing with their OS Property sites hosted on Plesk servers. Specifically, there have been reports of difficulties in saving ads within the administration panel. Users have noted that the operations are either very slow or fail entirely. Interestingly, disabling ModSecurity appears to resolve the issue, suggesting that the firewall may be misinterpreting legitimate requests as potential threats.
There are a few possible causes for this problem:
- False Positives: ModSecurity rules may incorrectly identify certain data, such as HTML content or special characters, as malicious, leading to blocked requests.
- Request Size Limits: If the ads contain large amounts of data or multiple images, they may exceed ModSecurity's configured limits, resulting in timeouts or errors.
- Rule Updates: Recent updates to ModSecurity rules may have introduced stricter checks, causing issues with OS Property.
To help you address this issue without compromising your site's security, I recommend the following steps:
- Switch ModSecurity to "Detection Only": This will allow you to monitor which rules are being triggered without blocking requests. You can find this option in Plesk under Tools & Settings > Web Application Firewall.
- Check ModSecurity Logs: After attempting to save an ad, review the logs to identify which rule IDs are causing the block. This information is crucial for further action.
- Whitelist Specific Rule IDs: Once you've identified the problematic rules, you can add exceptions for those specific IDs. This can be done by modifying the Apache directives for your domain in Plesk. For example:
<IfModule mod_security2.c>
SecRuleRemoveById [rule_id]
</IfModule>
- Replace [rule_id] with the actual ID causing the issue.
- Increase Request Body Limits: If the problem persists due to request size, consider increasing the limits in the ModSecurity configuration:
SecRequestBodyLimit 134217728 # 128 MB
SecRequestBodyNoFilesLimit 10485760 # 10 MB
- Test Again: After making these adjustments, try saving an ad again to see if the issue is resolved.
By following these steps, you should be able to resolve the issues with OSProperty while maintaining the security benefits of ModSecurity. If you continue to experience problems, please feel free to reach out for further assistance.
Thanks
Dam
