关于mod_security - 北美网备份站

Apache Mod Security update, How to Fix ‘Error 406’ or ‘Not Acceptable’ issue" `" V! J' ~0 `2 m! d$ X: S# _
last updated: october 28, 20161 ~! e+ H+ ^- j% T" _
Few weeks ago I started having “Not Acceptable! Error 406” on one of my WordPress sites when trying to save a post or a page. I kept getting the following message when trying to save a post.; [+ {$ @5 R& V% Z+ \& N+ a
$ U. K/ n. v4 q1 I& j! d
Not Acceptable
* L: P& R2 { C( S0 b9 x" q( [
An appropriate representation of the requested resource /wp-admin/post.php could not be found on this server
) m/ z4 M' a3 f4 u6 p8 D6 J
. r; Z+ [' O- \/ S. e" v
I tried many fixes and nothing seemed to have helped getting rid of the issue. So I decided to reinstall WordPress (How to Uninstall and Reinstall WordPress). Even the reinstall didn’t help! Later I found out that the “Not acceptable! Error 406” occurs due to Mod Security updates on the server. So if you are having a similar problem then you can try one of the following methods to fix it./ s" [) Q/ I% m% g/ W
" z3 z |% Z; E' _
Solution 1 for Fixing 406 Error
0 m; _, p- f# s* _$ X
% z, \# d* r$ C3 A
Backup your .htaccess file if you have one in the ‘wp-admin’ directory. Then make a ‘.htaccess’ file with the following content and upload it to ‘wp-admin’ directory.
# w& k5 h6 `) [8 g& j5 ]
! R+ c( V, N' @0 }* }' U5 L0 g% Z
<IfModule mod_security.c>
( I: L6 g0 j K- I
SecFilterEngine Off- ^- F) {8 g. O5 e5 h2 Z& A
SecFilterScanPOST Off
</IfModule>+ O8 l! P( z* N, @0 ^6 M
You can use any text editor such as Notepad to create this file.0 B+ O2 S: Z1 d( G0 }8 a9 X
1 ?% i8 ?3 [, ^" C% l) ]/ @$ |* W8 r
You will need to upload this .htaccedss file to your server. So if you don’t know how to upload a file to your server then check this tutorial on FTP.
, \% w- k6 q% y7 u' V% C7 z
, c5 i5 |& g* b m. n; b
Solution 2 for Fixing 406 Error# {# n) K) I' N
8 l- j* R- u. A
This is the solution that worked for me for my WordPress site.: E5 C7 T7 ~4 x6 x& L
9 \' N1 Z2 Z. \; [& j* n& b" g' v
Backup your .htaccess file if you have one in the public_html directory.8 U, X2 n0 F t% N0 h& O( A$ c2 b
: | B, ^! l3 G2 Q" F5 [+ y. d) X
Open the .htaccess file with any text editor and observe the lines between the “# BEGIN WordPress” and “# END WordPress” tags. Make sure the lines look somewhat like the following. If not then update the file with the following content and upload it to the ‘public_html’ directory.
4 f0 v5 n* i d; I4 g
. w% }0 i; @% ]6 h3 V( U+ F3 B
# BEGIN WordPress$ f1 i: D3 ~/ \0 N1 E
<IfModule mod_rewrite.c>' |4 h, Y; e% W+ n" K6 { V
RewriteEngine On/ f4 X+ ^- f- R) ]
RewriteBase /
% A$ H% }) O& K$ f$ P
RewriteCond %{REQUEST_FILENAME} !-f
2 `% K! o5 f- G) Q! e, ]
RewriteCond %{REQUEST_FILENAME} !-d+ B' q% e* ~) g) w
RewriteRule . /index.php [L]
+ ~7 g7 b3 ~3 R
</IfModule>
6 p2 o) f$ [+ f4 O! G0 R1 K: L6 W8 C
# END WordPress
4 z2 F2 { e8 S& C" ]
Hopefully one of these solutions help fix your “Not Acceptable” error.
" S/ ~$ q' M6 S$ l8 N; L" W7 P
& F0 t' c* k. o6 S( e" X; ]8 P
Good luck!

复制代码

最近论坛里很多朋友求救，说出现了这个问题，最近我也被这个问题困扰着。多谢Funkey朋友的办法，问题终于解决。

问题说明：

后台设置页面无法保存，出现如下500错误页面：

forbidden
You don't have permission to access /dede/sys_info.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at www.******.com Port 80

问题一般出现在国外主机空间上【目前发现此问题的空间商有：Host1Plus，BlueHost，JustHost，Backy LLC】，dedecms 5.5 和 5.6 都会出现错误，可见是空间的问题，不是织梦的问题。

原因：
经过多方核实，可以确定，大多数的国外主机在配置 Apache 的时候启用了 mod_security ，也就是开启了安全检查，如果提交的信息中包含 select , % , bin 等关键字，Apache 就会禁止，并给出 403，404，500 等错误。

解决方法：
由于这个设置属于服务器级别的配置，如果是VPS用户，需要关闭 mod_security2 的检查（mod_security2.c）；而如果是虚拟空间用户的话需要联系客服协助修改。

操作办法：
（虚拟空间用户）如果是CP面板，选择 Submit ticket——Paid hosting support，告诉客服自己使用 DEDE_CMS，请求将 mod_security 设置为 disabled 即可正常使用。
英语不好的朋友，可以直接复制以下语句：
引用
I wanna use DEDE_CMS,So please change mod_security2.c settings to disable.

$_config['security']['querysafe']['status'] = 1; // 是否开启SQL安全检测，可自动预防SQL注入攻击: A. P9 P, s" s. a
$_config['security']['querysafe']['dfunction']['0'] = 'load_file';" n. D1 |8 b& V# v
$_config['security']['querysafe']['dfunction']['1'] = 'hex';% O; T8 s. i) V2 a
$_config['security']['querysafe']['dfunction']['2'] = 'substring';, V9 k6 r% P5 x2 j. `! h6 j0 j
$_config['security']['querysafe']['dfunction']['3'] = 'if';- d9 C0 ?4 s6 J" [! v% D
$_config['security']['querysafe']['dfunction']['4'] = 'ord';7 K. o G& h# z- `3 Y6 B9 V) W9 m* g
$_config['security']['querysafe']['dfunction']['5'] = 'char';
. M( J2 ?: O' B- {5 k. G
$_config['security']['querysafe']['daction']['0'] = 'intooutfile';
0 _" {8 h3 x- v9 b) v
$_config['security']['querysafe']['daction']['1'] = 'intodumpfile';+ ?6 S% A2 n7 G3 Q4 ]5 ?
$_config['security']['querysafe']['daction']['2'] = 'unionselect';
3 E0 `2 c# k$ \" M+ ~: R
$_config['security']['querysafe']['daction']['3'] = '(select';6 M" R6 R4 f- b# |9 S2 l
$_config['security']['querysafe']['daction']['4'] = 'unionall';
* \/ N" o- Q+ K1 @
$_config['security']['querysafe']['daction']['5'] = 'uniondistinct';; i7 [ J, P3 q& @
$_config['security']['querysafe']['dnote']['0'] = '/*';& a+ Y' f, L! w
$_config['security']['querysafe']['dnote']['1'] = '*/';
/ r6 O4 x: X+ F! F
$_config['security']['querysafe']['dnote']['2'] = '#';
2 Z0 I6 r" A1 ~3 A, ~' B
$_config['security']['querysafe']['dnote']['3'] = '--';
, S8 ^. l: S+ d( J" y+ i% B
$_config['security']['querysafe']['dnote']['4'] = '"';% i* p/ {; [# z9 f
$_config['security']['querysafe']['dlikehex'] = 1;
% X9 p- N# x5 D9 p
$_config['security']['querysafe']['afullnote'] = '0';

复制代码