-----Original Message----- From: Dada Mail (Justin Simoni) [mailto:dada@skazat com] Sent: May 25, 2006 5:01 PM To: bruno@digi-land com Subject: [dadadev] mod_security and Dada Mail

Hello all,

I've been working on a client's install, and we've found that the
apache plugin, "mod_security" -> http://www modsecurity org/ seems to
hose Dada Mail's mailing list message sending You'll receive lines
in the apache error log that say things like:

[Thu May 25 07:51:21 2006] [error] [client 12 345 123 341] mod_security: Warning Pattern match "([0-9a-zA-Z]+[- +&])*[0-9a-zA-Z]+@([-0-9a-zA-Z]+[ ])+[a-zA-Z ]{2,6}" at POSTPAYLOAD [hostname "example com"] [uri "/cgi-bin/dada/mail cgi"]

That I'm not quite sure what the pattern is matching, but it looks
like an email address (I think?!)

Turning mod_security, off seems to relieve the problem You may
have luck turning mod_security off using an htaccess file in the cgi- bin/dada directory, with this as its contents:

SecFilterEngine Off

I'll let you guys know more information, when I find out more
information myself

If anyone seems to have similar problems, please, let me know,

-- Justin Simoni

[snip]

mod_security is an open source firewall As such it implements rules such as the one you are seeing where it check POST values agains this pattern (email validation) Presumably to detect and cut down on spam :) For the paranoid there is no need to turn of mod_security, just ditch the rule

Bruno Cantieni

#

Digital Landscape - Cyboretum com Web Applications * Web Hosting * e-Commerce http://www digi-land com http://www cyboretum com bruno@digi-land com Phone/Fax: 1+905 668 2255 Toll free: 1+877 668 2345

Digital Landscape and Cyboretum com are divisions of CBF Productions Inc