diff --git a/CHANGES b/CHANGES index 1bfa104b..fccf7392 100644 --- a/CHANGES +++ b/CHANGES @@ -4,8 +4,8 @@ * Fixed XML DTD/Schema validation which will now fail after request body processing errors, even if the XML parser returns a document tree. - * Added ctl:requestBodyBuffering=on|off which, when enabled, will force - the request body to be buffered and allow REQUEST_BODY to be inspected. + * Added ctl:forceRequestBodyVariable=on|off which, when enabled, will force + the REQUEST_BODY variable to be set and allow it to be inspected. Previously the REQUEST_BODY target was only populated if the request body was a parsable type (application/x-www-form-urlencoded or multipart/form-data) or was forced to be parsed via ctl:requestBodyProcessor. diff --git a/apache2/re_actions.c b/apache2/re_actions.c index c791d2e5..f565dcdf 100644 --- a/apache2/re_actions.c +++ b/apache2/re_actions.c @@ -713,10 +713,10 @@ static char *msre_action_ctl_validate(msre_engine *engine, msre_action *action) */ return NULL; } else - if (strcasecmp(name, "requestBodyBuffering") == 0) { + if (strcasecmp(name, "forceRequestBodyVariable") == 0) { if (parse_boolean(value) == -1) { return apr_psprintf(engine->mp, "Invalid setting for ctl name " - " requestBodyBuffering: %s", value); + " forceRequestBodyVariable: %s", value); } return NULL; } else @@ -838,7 +838,7 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp, return 1; } else - if (strcasecmp(name, "requestBodyBuffering") == 0) { + if (strcasecmp(name, "forceRequestBodyVariable") == 0) { int pv = parse_boolean(value); if (pv == -1) return -1; diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index f570119b..0cc57332 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -4411,7 +4411,7 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,ctl:requestBodyProce - requestBodyBuffering + forceRequestBodyVariable @@ -4437,7 +4437,7 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,ctl:requestBodyProce With the exception of requestBodyProcessor and - requestBodyBuffering, each configuration option corresponds to + forceRequestBodyVariable, each configuration option corresponds to one configuration directive and the usage is identical. The requestBodyProcessor option allows you to configure the @@ -4460,9 +4460,10 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,ctl:requestBodyProce moreinfo="none">REQUEST_BODY phase and an appropriate action taken. - The requestBodyBuffering option allows you to configure the - request body to be buffered (in memory) even if it is not parsed. This - allows inspection of REQUEST_BODY even when no parser is used. + The forceRequestBodyVariable option allows you to configure the + REQUEST_BODY variable to be set even if the request body was not parsed. + This allows inspection of REQUEST_BODY even when no parser is used. +