fix FP for photos app (albums, sharedalbums, places) (#36)

* fix FP for photos app (albums, sharedalbums, places) --------- Co-authored-by: Esad Cetiner <[email protected]>
coreruleset · Sep 25, 2023 · 0503575 · 0503575
1 parent 3274259
commit 0503575
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/plugins/nextcloud-rule-exclusions-before.conf b/plugins/nextcloud-rule-exclusions-before.conf
@@ -1224,6 +1224,22 @@ SecRule REQUEST_FILENAME "@rx /apps/photos/api/v[0-9]+/preview/[0-9]+$" \
         "t:none,\
         ctl:ruleRemoveById=950100"
 
+# Photos: Albums, Shared Albums, Places
+# Allow the data type 'text/plain'
+# Since the content is actually XML, we switch on the XML parser
+SecRule REQUEST_FILENAME "@rx /remote\.php/dav/photos/[^/]+/(?:albums|sharedalbums|places)(?:/[^/]+)?/$" \
+    "id:9508952,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    ver:'nextcloud-rule-exclusions-plugin/1.0.0',\
+    chain"
+    SecRule REQUEST_HEADERS:Content-Type "@rx ^text/plain(?:\;charset=UTF-8)?$" \
+        "t:none,\
+        ctl:requestBodyProcessor=XML,\
+        setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/plain|'"
+
 #
 # [ Nextcloud Files ]
 #