Fix disruptive action flow while RuleEngine is in DetectionOnly

This commit is contained in:
Felipe Zimmerle
2015-09-17 10:49:12 -03:00
parent 490ad23e41
commit 11e1a67d58
8 changed files with 136 additions and 27 deletions

View File

@@ -242,14 +242,14 @@
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule ARGS \"@contains test\" \"id:1,t:trim,status:500\""
"SecRule ARGS \"@contains test\" \"id:1,t:trim,deny,status:500\""
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "actions :: phase:1,trim,status:500",
"title": "actions :: phase:1,trim,status:500,deny",
"client": {
"ip": "200.249.12.31",
"port": 2313
@@ -303,14 +303,14 @@
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule ARGS \"@contains test\" \"id:1,phase:1,t:trim,status:500\""
"SecRule ARGS \"@contains test\" \"id:1,phase:1,t:trim,status:500,deny\""
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "actions :: phase:4,trim,status:500",
"title": "actions :: phase:4,trim,status:500,deny",
"client": {
"ip": "200.249.12.31",
"port": 2313
@@ -364,7 +364,7 @@
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule ARGS \"@contains test\" \"id:1,phase:4,t:trim,status:500\""
"SecRule ARGS \"@contains test\" \"id:1,phase:4,t:trim,status:500,deny\""
]
}
]