Problem/Motivation
On certain web server setups, root.js?v=<version> file, which is loaded from the global-styling library in root theme, fails to load with a 406 Access Denied error due to Apache Modsecurity rules.
Request: GET /themes/contrib/root/assets/js/root.js?v=3.0.0-alpha2
Action Description: Access denied with code 406 (phase 2).
Justification: Pattern match "/(new(cmd|command)|(cmd|command)[0-9]+|pro18|shell|sh|bash|get|root|nmap|asc|lila)\\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|htm|html|tmp|php|asp)\\?" at REQUEST_URI.
I have setup a Drupal installation on a AlmaLinux Server using WHM/cPANEL (https://cpanel.net/products/cpanel-whm-features/) which is a very popular web hosting manager. Out of the box, the modsecurity rules where already in place when the web server was setup by hosting provider.
This can be an issue with hosting services where end users may not have administrative access to modsecurity configurations.
Steps to reproduce
- Set up web server with apache modsecurity restriction that does not permit usages of
root.js?v=<version_number> like the pattern shown above
- Set up Drupal application on web server with root theme set as the admin theme
- Login and attempt to add content, once on that page, click on three dots on the top right of the web page, javascript interaction broken
- accessing http(s):///themes/contrib/root/assets/js/root.js?v=3.0.0-alpha2 returns access denied error
Proposed resolution
Renaming the root.js file to a non restricted naming convention.
Comments
Comment #2
asierrajr commentedComment #3
m.abdulqader commentedThank you
Could you please upload a patch for that to deploy it.
Thank you
Comment #4
asierrajr commentedHere is the patch.
I pre-append the name of the file with
seeds, following your naming conventions in other modules you manageI tested this on the server with the modsecurity restrictions and patch works.
Because I am renaming a file, please note that the patch only works in Linux environments via Composer Patches.
It does work using
git applyIf you are trying to test this on Mac OS, note that the patch may not work (renaming the fie) unless you install an OS packages via hombrew
https://github.com/cweagans/composer-patches/issues/326
Comment #7
m.abdulqader commented