theme-edit, mod_security and xss injection attacks

[shawn_a]

If your host allows it, you can override mod_security per .htaccess file.

This for example will disable it based on a specific IP match and if POST data.

SetEnvIf Remote_Addr ^xxx\.xxx\.xxx\.xxx$ MODSEC_ENABLE=Off
SetEnvIf Request_Method !^POST$ MODSEC_ENABLE=On

If not then you may have to get your host to allow a whitelist.

There are ways which you can then specify unique ids or files to include or exclude.