[pmwiki-users] Problem editing pages -- mod_security the cause?

[Christian Ridderström]

Hi,

I've move the LyX wiki to a new site and encountered something I haven't 
seen before. Basically I can click the edit link and be shown the web page 
with the edit form, but when I press SAVE, I get an error 400.

Here's what I found in the error log:

[Thu Mar 26 00:18:34 2009] [error] [client 201.38.240.167] ModSecurity: 
Access denied with code 400 (phase 2). Pattern match
"\\\\%(?!$|\\\\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" at ARGS:text. [id 
"950107"] [msg "URL Encoding Abuse Attack Attempt"] [severity "WARNING"] 
[hostname "wiki.lyx.org"]
[uri "/LyX/LyxFunctions?action=edit"] [unique_id 
"t-bZsNTJRSsAAFdQ568AAAAB"]


So it seems that ModSecurity might be stopping it... but its strange to 
me, especially as the first request that generates the web page with the 
edit form looks the same, i.e.
         /LyX/LyxFunctions?action=edit

The difference between the two requests could be that first one is a GET, 
whereas the second one is a POST.

Then there is something else that's also strange... the web site was also 
relocated to the same server, and that site is really a pmwiki site in 
disquise, and on the web site the editsing works!

Any ideas on how to solve this, or to troubleshoot it further?

regards,
Christian

-- 
Christian Ridderström				Mobile: +46-70 687 39 44