coreruleset · dune73 · Dec 9, 2020 · Dec 3, 2020 · Dec 8, 2020 · Dec 8, 2020
diff --git a/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf b/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
@@ -116,7 +116,7 @@ SecAction "id:9001100,\
 #
 SecRule REQUEST_FILENAME "@endsWith /core/install.php" \
     "id:9001110,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:account[pass][pass1],\
@@ -125,7 +125,7 @@ SecRule REQUEST_FILENAME "@endsWith /core/install.php" \
 
 SecRule REQUEST_FILENAME "@endsWith /user/login" \
     "id:9001112,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -134,7 +134,7 @@ SecRule REQUEST_FILENAME "@endsWith /user/login" \
 
 SecRule REQUEST_FILENAME "@endsWith /admin/people/create" \
     "id:9001114,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass[pass1],\
@@ -143,7 +143,7 @@ SecRule REQUEST_FILENAME "@endsWith /admin/people/create" \
 
 SecRule REQUEST_FILENAME "@rx /user/[0-9]+/edit$" \
     "id:9001116,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:current_pass,\
@@ -165,15 +165,15 @@ SecRule REQUEST_FILENAME "@rx /user/[0-9]+/edit$" \
 #
 SecRule REQUEST_FILENAME "@contains /admin/config/" \
     "id:9001122,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=942430,\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@endsWith /admin/config/people/accounts" \
     "id:9001124,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=920271,\
@@ -190,7 +190,7 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/people/accounts" \
 
 SecRule REQUEST_FILENAME "@endsWith /admin/config/development/configuration/single/import" \
     "id:9001126,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=920271,\
@@ -199,7 +199,7 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/development/configuration/sing
 
 SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
     "id:9001128,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=942440,\
@@ -216,7 +216,7 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
 #
 SecRule REQUEST_FILENAME "@endsWith /contextual/render" \
     "id:9001140,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetById=942130;ARGS:ids[],\
@@ -251,7 +251,7 @@ SecAction "id:9001160,\
 #
 SecRule REQUEST_FILENAME "@endsWith /admin/config/content/formats/manage/full_html" \
     "id:9001170,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:editor[settings][toolbar][button_groups],\
@@ -329,7 +329,7 @@ SecRule REQUEST_METHOD "@streq POST" \
 #
 SecRule REQUEST_FILENAME "@endsWith /node/add/article" \
     "id:9001200,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\
@@ -338,7 +338,7 @@ SecRule REQUEST_FILENAME "@endsWith /node/add/article" \
 
 SecRule REQUEST_FILENAME "@endsWith /node/add/page" \
     "id:9001202,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\
@@ -347,7 +347,7 @@ SecRule REQUEST_FILENAME "@endsWith /node/add/page" \
 
 SecRule REQUEST_FILENAME "@rx /node/[0-9]+/edit$" \
     "id:9001204,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\
@@ -357,47 +357,47 @@ SecRule REQUEST_FILENAME "@rx /node/[0-9]+/edit$" \
 
 SecRule REQUEST_FILENAME "@endsWith /block/add" \
     "id:9001206,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@endsWith /admin/structure/block/block-content/manage/basic" \
     "id:9001208,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:description,\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@rx /editor/filter_xss/(?:full|basic)_html$" \
     "id:9001210,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:value,\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@rx /user/[0-9]+/contact$" \
     "id:9001212,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message[0][value],\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
     "id:9001214,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:maintenance_mode_message,\
     ver:'OWASP_CRS/3.3.0'"
 
 SecRule REQUEST_FILENAME "@endsWith /admin/config/services/rss-publishing" \
     "id:9001216,\
-    phase:2,\
+    phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:feed_description,\

diff --git a/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf b/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
@@ -47,7 +47,7 @@ SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
 # User login password
 SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
     "id:9002100,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -80,7 +80,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
 # Post comment
 SecRule REQUEST_FILENAME "@endsWith /wp-comments-post.php" \
     "id:9002130,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -270,7 +270,7 @@ SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
 
 SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
     "id:9002401,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -672,7 +672,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/options.php" \
 # permalink_structure=/index.php/%year%/%monthnum%/%day%/%postname%/
 SecRule REQUEST_FILENAME "@endsWith /wp-admin/options-permalink.php" \
     "id:9002810,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -756,7 +756,7 @@ SecRule REQUEST_FILENAME "@rx /wp-admin/site-health.php" \
 # jquery-ui-accordion&ver=3f9999390861a0133beda3ee8acf152e
 SecRule REQUEST_FILENAME "@rx /wp-admin/load-(?:scripts|styles)\.php$" \
     "id:9002900,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\
@@ -773,7 +773,7 @@ SecRule REQUEST_FILENAME "@rx /wp-admin/load-(?:scripts|styles)\.php$" \
 # Site health output can trigger database error rule.
 SecRule REQUEST_FILENAME "@endsWith /wp-admin/site-health.php" \
     "id:9002910,\
-    phase:2,\
+    phase:1,\
     pass,\
     t:none,\
     nolog,\