关于mod_security - 北美网备份站

Apache Mod Security update, How to Fix ‘Error 406’ or ‘Not Acceptable’ issue
' b, S% e) w4 F3 N
last updated: october 28, 2016+ C0 k! o; O6 s. N* w$ d
Few weeks ago I started having “Not Acceptable! Error 406” on one of my WordPress sites when trying to save a post or a page. I kept getting the following message when trying to save a post.
( C6 Q6 r H' K( q; a' U
6 s, M& A7 Z J0 C; R" g" N
Not Acceptable( C7 r: p j9 D5 a t
An appropriate representation of the requested resource /wp-admin/post.php could not be found on this server
/ g2 l6 x$ \' ?. ~% V- ~9 ]4 D7 y; c
/ x8 E0 u. ~7 B; X2 C! B% o
I tried many fixes and nothing seemed to have helped getting rid of the issue. So I decided to reinstall WordPress (How to Uninstall and Reinstall WordPress). Even the reinstall didn’t help! Later I found out that the “Not acceptable! Error 406” occurs due to Mod Security updates on the server. So if you are having a similar problem then you can try one of the following methods to fix it.
0 x' ?1 Z0 d0 c/ {: }! Z" ^8 q
: g. ]: ]0 Y8 W4 q# S6 `9 v
Solution 1 for Fixing 406 Error
' s: q2 g8 D# z* l: o9 W$ U
X3 Z% P' G! L0 Y [
Backup your .htaccess file if you have one in the ‘wp-admin’ directory. Then make a ‘.htaccess’ file with the following content and upload it to ‘wp-admin’ directory.
& V" U& u" i U0 }4 Y& ^$ V. U3 W9 @
3 m8 ~1 {. \/ Y( { T# A
<IfModule mod_security.c>( R+ }# y$ A1 \
SecFilterEngine Off
7 U0 I8 E" ~+ _# ?
SecFilterScanPOST Off
/ r! Q( j; n# Y* D- T3 t8 A( b5 ^
</IfModule>; f# j7 c2 \3 U0 t M
You can use any text editor such as Notepad to create this file.
5 l4 G7 B; {8 @ R
. U* q" j( } d X+ U
You will need to upload this .htaccedss file to your server. So if you don’t know how to upload a file to your server then check this tutorial on FTP.9 I1 w# `( W% n" l- _. Y
$ Q1 V% R6 l0 d/ j# S) y. D5 g
Solution 2 for Fixing 406 Error
" E5 V% z9 P0 h
/ \1 H( [" Q7 ]# p1 N9 ?5 b \
This is the solution that worked for me for my WordPress site.; K" l. G& G) B* X2 t) S* s% O0 K
' f! @$ M2 R* ` O
Backup your .htaccess file if you have one in the public_html directory.
+ H2 D- {% g$ [# Q4 H$ G* E# C
! \) T/ s: ]6 c/ b$ ~+ q
Open the .htaccess file with any text editor and observe the lines between the “# BEGIN WordPress” and “# END WordPress” tags. Make sure the lines look somewhat like the following. If not then update the file with the following content and upload it to the ‘public_html’ directory.
) v$ S3 X% ^ S" g- H' s# L3 a
$ O# j- P! v( ^6 ^& q! l- Y' r
# BEGIN WordPress* f7 |7 N) o3 p) ?
<IfModule mod_rewrite.c>
; }7 `) x o9 I/ \2 t
RewriteEngine On4 ]+ t. ]$ l; \ P4 q
RewriteBase /
: g+ p, w/ b* @% X
RewriteCond %{REQUEST_FILENAME} !-f; ^8 B1 a/ H5 a
RewriteCond %{REQUEST_FILENAME} !-d
6 K( ^% I% ?+ U, U
RewriteRule . /index.php [L]
" |2 q; J/ [5 {' {
</IfModule>5 H a2 G' W. S, E6 n* z
# END WordPress) P Q8 L2 O7 L+ B; |1 E; ?
Hopefully one of these solutions help fix your “Not Acceptable” error.
. h9 A! W' V: Y) k5 U
/ s7 q; X% I" V; x8 z* I
Good luck!

复制代码

最近论坛里很多朋友求救，说出现了这个问题，最近我也被这个问题困扰着。多谢Funkey朋友的办法，问题终于解决。

问题说明：

后台设置页面无法保存，出现如下500错误页面：

forbidden
You don't have permission to access /dede/sys_info.php on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at www.******.com Port 80

问题一般出现在国外主机空间上【目前发现此问题的空间商有：Host1Plus，BlueHost，JustHost，Backy LLC】，dedecms 5.5 和 5.6 都会出现错误，可见是空间的问题，不是织梦的问题。

原因：
经过多方核实，可以确定，大多数的国外主机在配置 Apache 的时候启用了 mod_security ，也就是开启了安全检查，如果提交的信息中包含 select , % , bin 等关键字，Apache 就会禁止，并给出 403，404，500 等错误。

解决方法：
由于这个设置属于服务器级别的配置，如果是VPS用户，需要关闭 mod_security2 的检查（mod_security2.c）；而如果是虚拟空间用户的话需要联系客服协助修改。

操作办法：
（虚拟空间用户）如果是CP面板，选择 Submit ticket——Paid hosting support，告诉客服自己使用 DEDE_CMS，请求将 mod_security 设置为 disabled 即可正常使用。
英语不好的朋友，可以直接复制以下语句：
引用
I wanna use DEDE_CMS,So please change mod_security2.c settings to disable.

$_config['security']['querysafe']['status'] = 1; // 是否开启SQL安全检测，可自动预防SQL注入攻击
! v5 |0 {* B- S) U {
$_config['security']['querysafe']['dfunction']['0'] = 'load_file';; K" d$ c4 l, t6 q/ `: H/ h
$_config['security']['querysafe']['dfunction']['1'] = 'hex';
& D6 c- K! N' @# ?$ r
$_config['security']['querysafe']['dfunction']['2'] = 'substring';
- e6 X! |, v9 h9 y- b
$_config['security']['querysafe']['dfunction']['3'] = 'if';
/ s" i: X( G4 G0 d; h
$_config['security']['querysafe']['dfunction']['4'] = 'ord';2 k4 P2 P3 ]4 u$ a' a+ \
$_config['security']['querysafe']['dfunction']['5'] = 'char';* K3 s8 K: L1 D+ F Y
$_config['security']['querysafe']['daction']['0'] = 'intooutfile';$ z* X' Z' ]2 S8 i( u9 ^
$_config['security']['querysafe']['daction']['1'] = 'intodumpfile';
$ W8 I4 r8 B/ u$ T
$_config['security']['querysafe']['daction']['2'] = 'unionselect';- d8 |- a0 g9 Z* p+ s! w1 u
$_config['security']['querysafe']['daction']['3'] = '(select';: I1 y; R* K1 x$ ^( x% R6 ^# @
$_config['security']['querysafe']['daction']['4'] = 'unionall';
) }4 W: X- J7 Z- ^# _- J2 T: e
$_config['security']['querysafe']['daction']['5'] = 'uniondistinct';
& }5 a( H% f, Y4 X0 c6 i
$_config['security']['querysafe']['dnote']['0'] = '/*';
2 O! U: U6 v7 q3 }, e5 j4 W
$_config['security']['querysafe']['dnote']['1'] = '*/';! E! P' R" e& \4 {, d$ m
$_config['security']['querysafe']['dnote']['2'] = '#';
$ R& [, S4 E0 B2 F3 Q3 a" h
$_config['security']['querysafe']['dnote']['3'] = '--';, _* D8 ~4 F( N s" }
$_config['security']['querysafe']['dnote']['4'] = '"';
% O0 o5 H/ g+ o( j& Z
$_config['security']['querysafe']['dlikehex'] = 1;
) k' v9 s0 m: A( p: _- H% _1 I
$_config['security']['querysafe']['afullnote'] = '0';

复制代码