plugin.yaml

schema_version: 1

plugin:
  name: phpmyadmin-rule-exclusions-plugin
  description: Rule exclusions for phpMyAdmin so it runs without false positives under CRS.
  long_description: |
    Adds targeted SecRuleUpdateTargetById / ctl:ruleRemoveTargetById exclusions for the
    phpMyAdmin web interface for MySQL/MariaDB administration. Covers both the legacy URL
    routing scheme used before phpMyAdmin 5.1.0 and the route-based scheme introduced in
    5.1.0, so the correct set of exclusions can be selected via a configuration variable.
    Targets false positives triggered by SQL editor pages, table/row edit and delete
    operations, imports/exports, triggers/events/views, and session/persistent cookies.
  type: official
  category: rule-exclusion
  status: tested
  license: Apache-2.0
  authors:
    - name: OWASP CRS Team
      url: https://coreruleset.org
  repository: https://github.com/coreruleset/phpmyadmin-rule-exclusions-plugin
  keywords:
    - phpmyadmin
    - mysql
    - mariadb
    - database-administration
    - false-positives

rule_id_range:
  start: 9513000
  end: 9513999

compatibility:
  crs_version: ">=4.0.0"

configuration:
  file: plugins/phpmyadmin-rule-exclusions-config.conf
  variables:
    - name: tx.phpmyadmin-rule-exclusions-plugin_enabled
      type: boolean
      default: 1
      description: Enables the plugin. Set to 0 to disable all phpMyAdmin rule exclusions.
    - name: tx.phpmyadmin-rule-exclusions-plugin_url_format
      type: enum
      allowed_values:
        - v51
        - old
      default: v51
      description: >-
        Selects which set of exclusions to apply based on the phpMyAdmin URL routing
        scheme. Use "v51" for phpMyAdmin 5.1.0 and later (route-based URLs), or "old"
        for versions prior to 5.1.0.