Answers.Body: <p>Assuming the webhook runs as a specific user, you can disable the IDS (it's one of the permission)</p>
  
  <p>So if you create (on drupal) a role "trusted user", disable the IDS check permission for that role only and grant that role to the webhook user, you should be ok</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-13T15:22:10.807Z
Answers.Text: the webhook is sent by mandrill without authentication so i thought I had to disable for all anon users - is there another way?  Also, was hoping the config for IDS might part of the civi config management system rather than in the module directory.  Perhaps I can use the custom php over-rides?  I hate to muck with the module code base.
Answers.UserDisplayName: Sonicthoughts
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-13T15:04:00.207Z
Answers.LastActivityDate: 2015-05-13T15:04:00.207Z
Answers.UserDisplayName: Xavier
Answers.Body: <p>You can programmatically exclude certain URLs from IDS checks using the <a href="https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_idsException/" rel="nofollow noreferrer">idsExcpetion hook</a>. That seems like the safest approach.</p>
  
  <p>The <a href="https://github.com/JMAConsulting/biz.jmaconsulting.mte/issues/105" rel="nofollow noreferrer">mandrill issue</a> references the <a href="https://github.com/teamsinger/uk.teamsinger.civicrm.mailgun" rel="nofollow noreferrer">mailgun extension README file</a> which says you can set the constant <code>CIVICRM_IDS_SKIP</code> to a serialized array of paths to skip because core has been patched - but I tried grepping the code for that constant and don't see it anywhere.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-08-08T15:20:38.310Z
Answers.LastActivityDate: 2017-08-08T15:20:38.310Z
Answers.UserDisplayName: Jamie
Answers.Body: <p>I recall this issue and seem to recall we addressed it some time ago in the Mandrill extension with assistance from Tim Otten. Maybe check the github issue queue for the extension. Are you running the latest version of Mandrill extension? I'll try put out a new version by Tuesday.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-17T02:02:03.467Z
Answers.Text: I tried on latest and it triggered ids message in watchdog but I didn't verify if Webhook worked.
Answers.UserDisplayName: Sonicthoughts
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-05-15T20:19:35.487Z
Answers.LastActivityDate: 2015-05-15T20:19:35.487Z
Answers.UserDisplayName: Joe Murray
Body: <p>Civicrm has a built-in layer of intrusion detection using a library called <a href="https://github.com/PHPIDS/PHPIDS" rel="nofollow">PHPIDS</a>.  Unfortunately, I often have to disable for webhooks and other things that get trapped.  For example, using the mandrill extension, the system flags the webhook as an intrusion.</p>
  
  <p>I'm sure there is a way to hack/patch the code, but is an IDS configuration profile supported somehow?  I couldn't find any documentation. </p>
  
Tags: <security>
Title: Best way to configure IDS?
ThreadText: # Best way to configure IDS?
  
  (Asked by: username_0 on 2015-05-13)
  
  Civicrm has a built-in layer of intrusion detection using a library called [PHPIDS](https://github.com/PHPIDS/PHPIDS). Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the mandrill extension, the system flags the webhook as an intrusion.
  
  I'm sure there is a way to hack/patch the code, but is an IDS configuration profile supported somehow? I couldn't find any documentation.
  
  **Tags:** security
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2015-05-13. Score: 1
  
  Assuming the webhook runs as a specific user, you can disable the IDS (it's one of the permission)
  
  So if you create (on drupal) a role "trusted user", disable the IDS check permission for that role only and grant that role to the webhook user, you should be ok
  
  > **Comments:**
  > **username_0**: the webhook is sent by mandrill without authentication so i thought I had to disable for all anon users - is there another way?  Also, was hoping the config for IDS might part of the civi config management system rather than in the module directory.  Perhaps I can use the custom php over-rides?  I hate to muck with the module code base.  
  
  ---
  
  ### Answer by username_2 on 2017-08-08. Score: 0
  
  You can programmatically exclude certain URLs from IDS checks using the [idsExcpetion hook](https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_idsException/). That seems like the safest approach.
  
  The [mandrill issue](https://github.com/JMAConsulting/biz.jmaconsulting.mte/issues/105) references the [mailgun extension README file](https://github.com/teamsinger/uk.teamsinger.civicrm.mailgun) which says you can set the constant `CIVICRM_IDS_SKIP` to a serialized array of paths to skip because core has been patched - but I tried grepping the code for that constant and don't see it anywhere.
  
  
  ---
  
  ### Answer by username_3 on 2015-05-15. Score: 0
  
  I recall this issue and seem to recall we addressed it some time ago in the Mandrill extension with assistance from Tim Otten. Maybe check the github issue queue for the extension. Are you running the latest version of Mandrill extension? I'll try put out a new version by Tuesday.
  
  > **Comments:**
  > **username_0**: I tried on latest and it triggered ids message in watchdog but I didn't verify if Webhook worked.  
  
  ---
  
  