[quote="jsibley" post=161488 I'm assuming I need to add or modify a rule to accept certain transactions (user-agent libcurl?)
[/quote]
You should post the rule instead of the ID. The mod security IDs are not telling me what rule is triggered.
Every ruleset can use these IDs.
Most common rule set with ID 990011 seems to be the Owasp-modsecurity-core-rule-set.
Code:
SecRule REQUEST_HEADERS:User-Agent "(?:\b(?:(?:indy librar|snoop)y|microsoft url control|lynx)\b|d(?:eek:wnload demon|isco)|w(?:3mirror|get)|l(?:ibwww|wp)|p(?:avuk|erl)|cu(?:sto|rl)|big brother|autohttp|netants|eCatch)" \
"chain,log,auditlog,msg:'Request Indicates an automated program explored the site',id:'990011',severity:'5'"
SecRule REQUEST_HEADERS:User-Agent "!^apache.*perl"
Since these rulesets are very broad it is quite common to tigger a few rules when using APIs from webapplications.
LimeSurvey is no exception. You can deactivate the rule globally or restrict exception to certain paths.
