XF 2.3 mod_security error on post attachment uploads

[TheLaw]

I have encountered an odd problem I'm troubleshooting now after upgrading to v2.3. I try to upload a 450kb png so its definitely not maxfilesize. I'm going to be working on this and will post a solution in case anyone else has had a problem. Lots of strange issues cropping up with 2.3, virtually all of them frustrating mod_security issues that need ID but once IDed and addressed, works well.

[Wed Jan 22 14:21:20.628334 2025] [:error] [pid 1426313:tid 1426321] [client xxxxxx:56133] [client xxxxxx3.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i?:^(-0000023456|-2147483648|-2147483649|0000012345|0000023456|1e309|2147483648|2147483647|2.2.90738585072007e-308|4294967295|4294967296)$))" at ARGS:flowChunkSize. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "32"] [id "211680"] [rev "2"] [msg "COMODO WAF: Looking for integer overflow attacks||www.mysite.com|F|2"] [data "Matched Data: 4294967296 found within ARGS:flowChunkSize: 4294967296"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.mysite.com"] [uri "/attachments/upload"] [unique_id "Z5FFMMIP3WgeiHwn6f7K9wAAAYY"], referer: https://www.mysite.com/forums/mods-forum.259/post-thread

 

[TheLaw]

In the logs, mod_security was offended and angry at me for trying to violate rule 211680, as per the log (see the [id "211680"] portion.) Needed to modify with "SecRuleRemoveById 211680" so that I could upload attachments, reboot, and coast again.