Drupal's Update Mechanism and Mod_Security

Hi everyone,

just a very quick post while I stumbled across this myself just a minute ago:

For those of you who have mod_security installed (with these great up-to-date rules from gotrules.com) on their server (or know, that their provider runs mod_security (you can find this out by searching for mod_security in the output of phpinfo()):

If you update anything and before you start the update process on the update.php page, temporarily switch OFF mod_security (by commenting it out in the httpd.conf or the conf.d/mod_security.conf - then restart apache), otherwise the update-process might be caught by mod_security and produce an error 406.

Once your update is finished do not forget to switch mod_security back on!

Steve.