Merge pull request #1743 from pyllyukko/fix-nextcloud-report-request

Allow REPORT requests without Content-Type header in Nextcloud
SpiderLabs · May 5, 2020 · 3711365 · 3711365
2 parents e988d3e + fb32edd
commit 3711365
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf b/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf
@@ -149,6 +149,19 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/files/" \
     ctl:ruleRemoveById=920440,\
     ver:'OWASP_CRS/3.2.0'"
 
+# Allow REPORT requests without Content-Type header (at least the iOS app does this)
+
+SecRule REQUEST_METHOD "@streq REPORT" \
+    "id:9003121,\
+    phase:2,\
+    pass,\
+    t:none,\
+    nolog,\
+    chain"
+    SecRule REQUEST_FILENAME "@contains /remote.php/dav/files/" \
+        "t:none,\
+        ctl:ruleRemoveById=920340"
+
 
 # [ Searchengine ]
 #