# ------------------------------------------------------------------------
# OWASP CRS Plugin
# Copyright (c) 2021-2024 CRS project. All rights reserved.
#
# The OWASP CRS plugins are distributed under
# Apache Software License (ASL) version 2
# Please see the enclosed LICENSE file for full details.
# ------------------------------------------------------------------------

# OWASP CRS Plugin
# Plugin name: phpbb-rule-exclusions
# Plugin description: 
# Rule ID block base: 9,512,000 - 9,512,999
# Plugin version: 1.0.0

# Documentation can be found here:
# https://github.com/coreruleset/phpbb-rule-exclusions-plugin

# Generic rule to disable plugin
SecRule TX:phpbb-rule-exclusions-plugin_enabled "@eq 0" "id:9512099,phase:1,pass,nolog,ctl:ruleRemoveById=9512100-9512999"


# Login
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512100,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq login" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=930100;ARGS:redirect,\
            ctl:ruleRemoveTargetById=930110;ARGS:redirect,\
            ctl:ruleRemoveTargetById=941100;ARGS:redirect,\
            ctl:ruleRemoveTargetById=942432;ARGS:redirect,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password"

# Registration
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512110,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq register" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:new_password,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password_confirm"

# Password change
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512120,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq reg_details" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:new_password,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:cur_password,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password_confirm"

# Redirect after admin login
SecRule REQUEST_FILENAME "@endsWith /adm/index.php" \
    "id:9512130,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule &ARGS:mode "@eq 0" \
        "t:none,\
        chain"
        SecRule &ARGS:username "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=930100;ARGS:redirect,\
            ctl:ruleRemoveTargetById=930110;ARGS:redirect"

# Creating and editing posts
# Argument 'subject_checked' is part or Prime Subject Check extension:
# https://www.phpbb.com/community/viewtopic.php?t=1056865
SecRule REQUEST_FILENAME "@endsWith /posting.php" \
    "id:9512140,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@rx ^(?:post|edit|quote|reply)$" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=921110;REQUEST_BODY,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\
            ctl:ruleRemoveTargetByTag=attack-injection-php;ARGS:subject,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:subject,\
            ctl:ruleRemoveTargetById=932130;ARGS:subject,\
            ctl:ruleRemoveTargetByTag=attack-injection-php;ARGS:subject_checked,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:subject_checked,\
            ctl:ruleRemoveTargetById=932130;ARGS:subject_checked,\
            ctl:ruleRemoveTargetById=933210;ARGS:attachment_data[0][real_filename],\
            ctl:ruleRemoveTargetById=933210;ARGS:real_filename"

# Creating and editing posts
# Rule 200004 (phase 2) was triggered when ARGS 'subject' or
# 'message' starts with two hyphen characters (--). This exclusion rule
# must be processed BEFORE rule 200004, so it needs to be in phase 1.
# Rule 200004 comes with ModSecurity and is defined in modsecurity.conf.
# It is trying to search for unmatched boundaries if multipart/form-data
# Content-Type is used (phpBB is using it when creating/editing posts
# via logged [non-guest] accounts). According to RFC 2046, boundaries
# must start with two hyphen characters and that's where FPs are coming
# from - with multipart/form-data as Content-Type, values of arguments
# send by a user are put on a new line.
SecRule REQUEST_FILENAME "@endsWith /posting.php" \
    "id:9512141,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveById=200004,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0'"

# Private messages
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512150,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@rx ^(?:compose|drafts)$" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\
            ctl:ruleRemoveTargetByTag=attack-injection-php;ARGS:subject,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:subject"

# Saving draft of a private message
# In this case, phpBB is sending both GET and POST 'mode' parameters togather (maybe a bug in phpBB?)
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512160,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS_GET:mode "@streq compose" \
        "t:none,\
        chain"
        SecRule ARGS_POST:mode "@streq compose" \
            "t:none,\
            chain"
            SecRule &ARGS:mode "@eq 2" \
                "t:none,\
                ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\
                ctl:ruleRemoveTargetByTag=attack-injection-php;ARGS:subject,\
                ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:subject"

# Profile - setting signature
SecRule REQUEST_FILENAME "@endsWith /ucp.php" \
    "id:9512170,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq signature" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=attack-xss;ARGS:signature,\
            ctl:ruleRemoveTargetByTag=attack-injection-php;ARGS:signature,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:signature"

# Settings - adding Google AdSense code using AdSense extension
# https://www.phpbb.com/customise/db/extension/adsense/
SecRule REQUEST_FILENAME "@endsWith /adm/index.php" \
    "id:9512180,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq settings" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=attack-xss;ARGS:config[google_adsense_html],\
            ctl:ruleRemoveTargetByTag=attack-rce;ARGS:config[google_adsense_html]"

# Installation
SecRule REQUEST_FILENAME "@endsWith /install/app.php/install" \
    "id:9512190,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetById=931130;ARGS:server_protocol,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0'"

# Viewing a post
SecRule REQUEST_FILENAME "@endsWith /viewtopic.php" \
    "id:9512200,\
    phase:4,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule REQUEST_METHOD "@streq GET" \
        "ctl:ruleRemoveTargetById=951240;TX:sql_error_match"

SecRule REQUEST_FILENAME "@endsWith /adm/index.php" \
    "id:9512210,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule ARGS:mode "@streq bbcodes" \
        "t:none,\
        chain"
        SecRule &ARGS:mode "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=941100;ARGS:bbcode_tpl,\
            ctl:ruleRemoveTargetById=941110;ARGS:bbcode_tpl,\
            ctl:ruleRemoveTargetById=941160;ARGS:bbcode_tpl,\
            ctl:ruleRemoveTargetById=941180;ARGS:bbcode_tpl,\
            ctl:ruleRemoveTargetById=942230;ARGS:bbcode_tpl"

# Tapatalk Plugin
SecRule REQUEST_FILENAME "@endsWith /mobiquo/mobiquo.php" \
    "id:9512220,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'phpbb-rule-exclusions-plugin/1.0.0',\
    chain"
    SecRule REQUEST_HEADERS:Content-Type "@beginsWith text/xml;" \
        "t:none,\
        ctl:ruleRemoveTargetById=921110;XML"
