HEX
Server: Apache
System: Linux belinyu.iixcp.rumahweb.net 4.18.0-553.123.2.lve.el8.x86_64 #1 SMP Thu May 7 23:17:13 UTC 2026 x86_64
User: sduw1495 (3615)
PHP: 7.4.33
Disabled: system,exec,escapeshellarg,escapeshellcmd,passthru,proc_close,proc_get_status,proc_nice,proc_open,proc_terminate,shell_exec,popen,pclose,dl,pfsockopen,leak,apache_child_terminate,posix_kill,posix_mkfifo,posix_setsid,posix_setuid,posix_setpgid,ini_alter,show_source,define_syslog_variables,symlink,syslog,openlog,openlog,closelog,ocinumcols,listen,chgrp,apache_note,apache_setenv,debugger_on,debugger_off,ftp_exec,dll,ftp,myshellexec,socket_bind,mail,posix_getwpuid
Upload Files
File: //opt/alt/python35/share/imunify360/scripts/modsec_scan.py
#!/bin/bash
# FIXME: workaround for bug https://cloudlinux.atlassian.net/browse/DEF-2271

if grep -q 'enable_scan_modsec:\s*true' /etc/sysconfig/imunify360/imunify360-merged.config; then
    out=($(/usr/share/imunify360/scripts/modsec_scan_real.py "$@"))
    echo "${out[@]}"
    # Script prints one of two possible lines:
    #   '1 OK' - when malware is not found in the file
    #   '0 Attempt to upload malware' - when malware has been found in the file
    # At the moment, Coraza does not handle script output properly:
    #   https://github.com/corazawaf/coraza/pull/1311
    # Thus we exit with code 1 to make Coraza pass the file and with code 0 to block the file.
    # The original modsec 2.x don't care about exit code either, so it should handle it fine.
    code=${out[0]}
    [[ "$code" =~ ^[0-9]+$ ]] || code=1
    exit $code
else
    echo "1 OK"
    exit 1
fi