Add new task crashes server because of Apache ModSecurity

[bielze]

So far this project looks amazing!

Checklist

• I verified that Kanboard is correctly installed
• I verified that the problem does not come from a plugin
• I verified that the problem is not already reported
• I understand that Kanboard is in maintenance mode. It doesn't mean it's abandoned, but there is no significant feature development

Actual behaviour

When I'm in the board view and try to add a new task, nothing happens. When I switch to list or other view my server crashes. According to the logs, it's due to modsecurity doing something

Expected behaviour

Show the add new task modal.

Logs

[client 2001:1c00:2490:8700:e41a:79e2:eb47:f9c4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\b(?:t(?:able_name\\b|extpos[^a-zA-Z0-9_]{1,}\\()|(?:a(?:ll_objects|tt(?:rel|typ)id)|column_(?:id|name)|mb_users|object_(?:id|(?:nam|typ)e)|pg_(?:attribute|class)|rownum|s(?:ubstr(?:ing){0,1}|ys(?:c(?:at|o(?:lumn|nstraint)s)|dba|ibm|(?:filegroup|o ..." at ARGS_NAMES:column_id. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/22_SQL_SQLi.conf"] [line "17"] [id "211540"] [rev "13"] [msg "COMODO WAF: Blind SQL Injection Attack||work.ndijk.com|F|2"] [data "Matched Data: column_id found within ARGS_NAMES:column_id: column_id"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "work.ndijk.com"] [uri "/"] [unique_id "YxkGa@1Y-B3zLYJEAxdINwAAAE8"]

Configuration

Application version: 1.2.23
PHP version: 8.1.10
PHP SAPI: fpm-fcgi
HTTP Client: cURL
OS version: Linux 3.10.0-1062.9.1.el7.x86_64
Database driver: sqlite
Database version: 3.7.17
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0

[fguillot]

See https://docs.kanboard.org/en/1.2.23/admin_guide/requirements.html#compatible-web-servers

[bielze]

Thanks for the quick reply! Don't know how I missed that..

[rautamiekka]

Can nothing be done on Kanboard's end to make it compatible ?

[fguillot]

Can nothing be done on Kanboard's end to make it compatible ?

Looks like mod_security does not like URLs with query strings.

Enabling URL rewrite and updating the code base to add the missing routes might work.

For reference: https://docs.kanboard.org/v1/admin/url-rewriting/