Topic: mod_security2 False Positives Webmail

[Envomni]

We run a webmail server on our newly mod_security2 modified system.

Sending plain old messages ("Hi how are ya? Did you get that report done yet?") etc works ok.

But include a link to a website, or a reference to a drive/letter path in the body of the message, and we get Method Not Implemented errors. So now are staff can't e-mail notes to each other that include any reference to websites. The problem was determined to be tied to rule on line 133 in the generic attacks rule set.

A similar problem occurs when trying to forward a message. It triggers rule on line 203 in the generic attacks rule set.

I've tried adding a SecRule to let the path \mail\src\compose.php be left alone by mod_security2, but it hasn't worked. I dont want to disable these rules as they strike me as being very valuable for protecting our system on other pages (such as user e-mail sign-up forms) in public areas on our site. Would someone have a suggestion on how to white list this specific webmail path?

[Envomni]

Any suggestions on a good mod_security2 white list guide side?