Mod_security turn off rule based on post data

Question

Is it possible to remove a specific security based on post data?

For example, if post data contain username='someone' then turn off rule 95004:

SecRuleRemoveById 950004

I already have SecRequestBodyAccess turned on

Answer 1

Location of the manual, which will give you guidance for creating the proper syntax for your installation: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)

You're not entirely clear in what you're after, but in general I think you're wanting the directive to begin something like:

SecRule ARGS_POST:username "someone" 

That will test the post argument 'username' for the value 'someone' and if they match, trigger the action part of the rule. The contents of the rest will depend largely upon your own configuration, so I can't include it here, but the general idea is:

"phase:1,id:nnnnnnn,t:lowercase,nolog,pass,maturity:2,accuracy:9,ctl:ruleRemove ById:95004"

You'll need to replace the values in this action list with those appropriate to your setup. The only other important thing is this rule needs to be executed before 95004 gets executed. Most configurations of mod_security have a place for local exceptions to go. Use that.