I'm having some issues deploying a CakePHP application on a secure server. The administrator has installed mod_security2, and it throws up an error when trying to validate my POST data from forms.
I haven't exactly nailed down if this is the issue, but I think mod_security strongly dislikes the brackets that are used in field names that the开发者_如何学运维 form helper generates. The field names are always of the form:
data[tablename][fieldname]
and when I submit forms that use these names, the apache logs tell me the following (newlines added for sanity):
[Mon Jun 27 11:14:48 2011] [error] [client 10.255.144.105]
ModSecurity: Warning. Operator LT matched 20 at TX:inbound_anomaly_score.
[file "/etc/httpd/modsecurity.d/base_rules/modsecurity_crs_60_correlation.conf"]
[line "31"] [msg "Inbound Anomaly Score (Total Inbound Score: 8, SQLi=, XSS=):
900030-Detects common XSS concatenation patterns 1/2"] [hostname "falcon.tamucc.edu"]
[uri "/~jgarcia4/index.php"] [unique_id "TgiseEBHUhAAAGHUhl0AAAAb"]
I gather that I'm triggering the XSS injection rule, and my guess is, it doesn't like the "][" in the field names. This happens when submitting empty forms, and also when submitting fully filled out forms. I've confirmed that PHP is not even getting called in this case.
I can't turn mod_security off, as it's not a server I control, so I'm stuck dealing with it. It seems like a logical "fix" would be to not use [] brackets in the field names, but I don't know how to tell the form handler to do that. All the tutorials seem just fine with the default naming convention.
Is there a way to globally change the way the form handler treats field names for input elements? Barring that, is there a way to override it for each individual element? I'm not entirely sure how cake's core engine handles the results-- if the Model expexts it to be in a particular format, then I may be stuck.
I'm not exactly sure how to do this. The following code might fail horribly or cause the FormHelper to not work at all. You would have to then manipulate your form data to have the proper array structure if you want to use Cake's model validation.
You could try:
$this->Form->input('Model.field', array('name' => 'yourSafeName'));
精彩评论