Error on certain page content

When certain code examples are entered on a page, the Server returns a “Error 403 – Forbidden”, “Error 406 – Not Acceptable”, “Error 403 – Forbidden” or similar errors. What's the problem?

This is usually a problem caused by overly-restrictive security policies set in the webserver (Usually mod_security).

There is no way to fix this in DokuWiki, because it is not a problem caused by DokuWiki itself. You need to check your webserver audit logs to identify the problematic rule and disable it.

Commonly problematic words are parts of SQL statements, mail or UNIX commands like:

• select … from
• drop …
• to: …
• wget …

Sometimes the problem also occurs when certain parameters are passed in the URL, especially when they contain external URLs like when using external images that are loaded from DokuWiki's image cache system in lib/exe/fetch.php.

On apache, mod_security can be disabled at a user or hosted domain level. The following two lines can be inserted in an .htaccess file that is saved in the [home_directory]/public_html directory:

SecFilterEngine Off
SecFilterScanPOST Off

–Chris Freyer 7/23/09

In some cases it is not allowed to disable the mod_security option in the .htacces file. You have to contact your provider and ask for disabling some rules. In my case:

• Rule 340009:
  ModSecurity: Access denied with code 403 (phase 2). Pattern match ”(?:/(?:etc|proc|var/tmp|usr|opt|s?bin|dev|tmp|kern|[br]oot|sys|windows|winnt)/|(?:\\/|\\\\)+inetpub|localstart\\.asp|boot\\.ini)” at ARGS:suffix. [file ”/etc/apache2/modsec2/10_asl_rules.conf”] [line “215”] [id “340009”] [rev “26”] [msg “Atomicorp.com WAF Rules:Protected Path Access denied in URI/ARGS”] [data ””] [severity “CRITICAL”]

• Rule 300001:
  ModSecurity: Access denied with code 403 (phase 2). Matched phrase “home.arcor.de” at REQUEST_BODY. [file ”/etc/apache2/modsec2/30_asl_antispam.conf”] [line “38”] [id “300001”] [rev “8”] [msg “Atomicorp.com WAF Rules: Blacklist Spam Domain”] [data ””] [severity “CRITICAL”]