When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 -- in it.


This was responsible for triggering ModSecurity rule:

942100 [msg "SQL Injection Attack Detected via libinjection]

Is it possible to define the characters Drupal generates for itok, without editing Drupal's Core, to exclude keyword specific characters like the-?

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.