diff --git a/docker/conf/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf b/docker/conf/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf index 7c0e241478e35c0ba50b7b60840b7d9f6debe598..93c06a7f662827d1c33d94fccc27a3d3fed26008 100644 --- a/docker/conf/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf +++ b/docker/conf/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf @@ -55,6 +55,7 @@ SecRule REQUEST_URI "@beginsWith /wp-json/wp/v2/widget-types/text/encode" \ nolog,\ ctl:ruleEngine=Off" +# Make WP-Piwik settings pages work. SecRule REQUEST_URI "@beginsWith /wp-admin/network/site-settings.php" \ "id:1009,\ phase:2,\ @@ -62,4 +63,11 @@ SecRule REQUEST_URI "@beginsWith /wp-admin/network/site-settings.php" \ nolog,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:option[wp-piwik-tracking_code],\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:option[wp-piwik-noscript_code]" +SecRule REQUEST_URI "@beginsWith /wp-admin/network/settings.php" \ + "id:1010,\ + phase:2,\ + pass,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:wp-piwik[tracking_code],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:wp-piwik[noscript_code]"