Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the mandrill extension, the system flags the webhook as an intrusion.

I'm sure there is a way to hack/patch the code, but is an IDS configuration profile supported somehow? I couldn't find any documentation.


Assuming the webhook runs as a specific user, you can disable the IDS (it's one of the permission)

So if you create (on drupal) a role "trusted user", disable the IDS check permission for that role only and grant that role to the webhook user, you should be ok

  • the webhook is sent by mandrill without authentication so i thought I had to disable for all anon users - is there another way? Also, was hoping the config for IDS might part of the civi config management system rather than in the module directory. Perhaps I can use the custom php over-rides? I hate to muck with the module code base. – Sonicthoughts May 13 '15 at 15:22

I recall this issue and seem to recall we addressed it some time ago in the Mandrill extension with assistance from Tim Otten. Maybe check the github issue queue for the extension. Are you running the latest version of Mandrill extension? I'll try put out a new version by Tuesday.

  • I tried on latest and it triggered ids message in watchdog but I didn't verify if Webhook worked. – Sonicthoughts May 17 '15 at 2:02

You can programmatically exclude certain URLs from IDS checks using the idsExcpetion hook. That seems like the safest approach.

The mandrill issue references the mailgun extension README file which says you can set the constant CIVICRM_IDS_SKIP to a serialized array of paths to skip because core has been patched - but I tried grepping the code for that constant and don't see it anywhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.