github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 13:56:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Change from ctl:requestBodyBuffering to ctl:forceRequestBodyVariable.

Browse Source
This commit is contained in:
brectanus 2008-09-10 17:11:20 +00:00
parent 5740f7a3eb
commit 309510d70b
3 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -4,8 +4,8 @@
* Fixed XML DTD/Schema validation which will now fail after request body * Fixed XML DTD/Schema validation which will now fail after request body
processing errors, even if the XML parser returns a document tree. processing errors, even if the XML parser returns a document tree.
* Added ctl:requestBodyBuffering=on|off which, when enabled, will force * Added ctl:forceRequestBodyVariable=on|off which, when enabled, will force
the request body to be buffered and allow REQUEST_BODY to be inspected. the REQUEST_BODY variable to be set and allow it to be inspected.
Previously the REQUEST_BODY target was only populated if the request body Previously the REQUEST_BODY target was only populated if the request body
was a parsable type (application/x-www-form-urlencoded or was a parsable type (application/x-www-form-urlencoded or
multipart/form-data) or was forced to be parsed via ctl:requestBodyProcessor. multipart/form-data) or was forced to be parsed via ctl:requestBodyProcessor.

6
apache2/re_actions.c
View File

@ -713,10 +713,10 @@ static char *msre_action_ctl_validate(msre_engine *engine, msre_action *action)
*/ */
return NULL; return NULL;
} else } else
if (strcasecmp(name, "requestBodyBuffering") == 0) { if (strcasecmp(name, "forceRequestBodyVariable") == 0) {
if (parse_boolean(value) == -1) { if (parse_boolean(value) == -1) {
return apr_psprintf(engine->mp, "Invalid setting for ctl name " return apr_psprintf(engine->mp, "Invalid setting for ctl name "
" requestBodyBuffering: %s", value); " forceRequestBodyVariable: %s", value);
} }
return NULL; return NULL;
} else } else
@ -838,7 +838,7 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp,
return 1; return 1;
} else } else
if (strcasecmp(name, "requestBodyBuffering") == 0) { if (strcasecmp(name, "forceRequestBodyVariable") == 0) {
int pv = parse_boolean(value); int pv = parse_boolean(value);
if (pv == -1) return -1; if (pv == -1) return -1;

11
doc/modsecurity2-apache-reference.xml
View File

@ -4411,7 +4411,7 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,<emphasis>ctl:requestBodyProce
</listitem> </listitem>
<listitem> <listitem>
<para><literal moreinfo="none">requestBodyBuffering</literal></para> <para><literal moreinfo="none">forceRequestBodyVariable</literal></para>
</listitem> </listitem>
<listitem> <listitem>
@ -4437,7 +4437,7 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,<emphasis>ctl:requestBodyProce
<para>With the exception of<literal moreinfo="none"> <para>With the exception of<literal moreinfo="none">
requestBodyProcessor</literal> and <literal moreinfo="none"> requestBodyProcessor</literal> and <literal moreinfo="none">
requestBodyBuffering</literal>, each configuration option corresponds to forceRequestBodyVariable</literal>, each configuration option corresponds to
one configuration directive and the usage is identical.</para> one configuration directive and the usage is identical.</para>
<para>The requestBodyProcessor option allows you to configure the <para>The requestBodyProcessor option allows you to configure the
@ -4460,9 +4460,10 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml nolog,pass,<emphasis>ctl:requestBodyProce
moreinfo="none">REQUEST_BODY</literal> phase and an appropriate action moreinfo="none">REQUEST_BODY</literal> phase and an appropriate action
taken.</para> taken.</para>
<para>The requestBodyBuffering option allows you to configure the <para>The forceRequestBodyVariable option allows you to configure the
request body to be buffered (in memory) even if it is not parsed. This REQUEST_BODY variable to be set even if the request body was not parsed.
allows inspection of REQUEST_BODY even when no parser is used.</para> This allows inspection of REQUEST_BODY even when no parser is used.
</para>
</section> </section>
<section> <section>