I seem to have a little problem with the excludes
I have this in my Audit log:
==6d394431==============================
Request:
www.foo.com 127.0.0.1 - - [11/Oct/2007:09:25:57 +0200] "POST /index.php?option=com_cmsrealty&Itemid=4&openrealty=616374696f6e3d656469745f6c697374696e677326616d703b656469743d3336392661646d696e3d74727565 HTTP/1.1" 403 285 "http://www.foo.com/component/option,com_cmsrealty/Itemid,4/openrealty,616374696f6e3d656469745f6c697374696e677326616d703b656469743d3336392661646d696e3d74727565/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7" - "-" ---------------------------------------- POST /index.php?option=com_cmsrealty&Itemid=4&openrealty=616374696f6e3d656469745f6c697374696e677326616d703b656469743d3336392661646d696e3d74727565 HTTP/1.1 Host: www.foo.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 510
mod_security-action: 403
mod_security-message: Access denied with code 403. Pattern match "((alter|create|drop)[[:space:]]+(column|database|procedure|table)|delete[[:space:]]+from|update.+set.+=)" at POST_PAYLOAD [id "300015"] [rev "1"] [msg "Generic SQL injection protection"] [severity "CRITICAL"]
510
action=update_listing&edit=369&title=Altbau-Miete&pclass%5B%5D=4&featured=no&edit_active=yes&mlsexport=no&or_owner=9&notes=&Adresse=Staudgasse&Stadt=Wien&Postleitzahl=1180&Preis=530&betr_kosten=&miete=&full_desc=Nette+Kleine+Zimmer+und+Kabinett+Wohnung%2C+Einbauk%FCche%2C+sehr+ger%E4umig%2C+Fliesenbad%2C+Toilette+Etagenheizung.Ruhelage+und+AKH+N%E4he&Zimmer=2&Badezimmer=1&year_built=1970&sq_feet=45&status=Aktiv&home_features%5B%5D=Einbauk%FCche&home_features%5B%5D=Gasetagenheizung&home_features%5B%5D=Lift
HTTP/1.1 403 Forbidden
Content-Length: 285
Keep-Alive: timeout=15, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
--6d394431--
but in excludes.conf I have added:
# cms_realty
<LocationMatch "/index.php?option=com_cmsrealty.*">
SecFilterRemove 300015
</LocationMatch>
I don't understand why this is still blocking. What am I doing wrong?
Regards, Cristian