diff --git a/CHANGES b/CHANGES index 47e31409..6114d98c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,14 +1,8 @@ -?? ??? 2007 - 2.5.0-trunk -------------------------- +?? ??? 2007 - 2.5.0-dev3 +------------------------ * Used new API calls to get the server version/banner when available. - * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity. - - * Quiet some compiler warnings. - - * Added ability to compile without an external API (-DNO_MODSEC_API). - * Added "logdata" meta action to allow safe logging of raw transaction data. * Added TX_SEVERITY that keeps track of the highest severity @@ -35,8 +29,23 @@ visibility attribute. -27 July 2007 - 2.1.2 --------------------- +11 Sep 2007 - 2.1.3 +------------------- + + * Updated multipart parsing code adding variables to allow checking + for various parsing issues (request body abnormalities). + + * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity. + + * Quiet some compiler warnings. + + * Do not block internal ErrorDocument requests after blocking request. + + * Added ability to compile without an external API (use -DNO_MODSEC_API). + + +27 Jul 2007 - 2.1.2 +------------------- * Cleaned up and clarified some documentation. diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h index 6afadc77..4daa9bca 100644 --- a/apache2/modsecurity.h +++ b/apache2/modsecurity.h @@ -58,8 +58,8 @@ extern DSOLOCAL modsec_build_type_rec modsec_build_type[]; #define MODSEC_VERSION_MAJOR "2" #define MODSEC_VERSION_MINOR "5" #define MODSEC_VERSION_MAINT "0" -#define MODSEC_VERSION_TYPE "trunk" -#define MODSEC_VERSION_RELEASE "99" +#define MODSEC_VERSION_TYPE "dev" +#define MODSEC_VERSION_RELEASE "3" #define MODULE_NAME "ModSecurity" #define MODULE_RELEASE \ diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 85dc4c75..3e078508 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -3,7 +3,7 @@ ModSecurity Reference Manual - Version 2.5.0-trunk / (September 7, 2007) + Version 2.5.0-dev3 / (September 14, 2007) 2004-2007 @@ -666,9 +666,9 @@ SecAuditLogStorageDir logs/audit I - This part is a replacement for part C. It will log the same data as C in all cases - except whenmultipart/form-data + except when multipart/form-data encoding in used. In this case it will log a fake application/x-www-form-urlencoded body + moreinfo="none">application/x-www-form-urlencoded body that contains the information about parameters but not about the files. This is handy if you don't want to have (often large) files stored in your audit logs. @@ -677,7 +677,7 @@ SecAuditLogStorageDir logs/audit J - RESERVED. This part, when implemented, will contain information about the files uploaded - using multipart/form-data encoding. + using multipart/form-data encoding. @@ -1910,16 +1910,17 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1 - application/x-www-form-urlencoded - used to transfer form - data - - - - multipart/form-data - used for file transfers - - - - text/xml - used for passing XML data + application/x-www-form-urlencoded - used to + transfer form data + + + + multipart/form-data - used for file + transfers + + + + text/xml - used for passing XML data @@ -3694,7 +3695,7 @@ SecRule REQUEST_URI "^/cgi-bin/script\.pl" \ - 1 - 99,999; reserved for local (internal) use. Use as you see + 1-99,999; reserved for local (internal) use. Use as you see fit but do not use this range for rules that are distributed to others. @@ -4730,10 +4731,11 @@ SecRule REQUEST_HEADERS:Ip-Address "!@streq %{TX.1} + check byte range in a POST payload when + multipart/form-data encoding (file upload) is used. + Doing so would prevent binary files from being uploaded. However, after + the parameters are extracted from such request they are checked for a + valid range. validateByteRange is similar to the ModSecurity 1.X SecFilterForceByteRange Directive however since it works in a rule @@ -4804,8 +4806,9 @@ SecRule XML "@validateSchema /path/to/apache2/conf/xml.xsd URL encoding is an HTTP standard for encoding byte values within a URL. The byte is escaped with a % followed by two hexadecimal values (0-F). This directive does not check encoding in a POST payload when the - multipart/form-data encoding (file upload) is used. It is not necessary - to do so because URL encoding is not used for this encoding. + multipart/form-data encoding (file upload) is used. + It is not necessary to do so because URL encoding is not used for this + encoding.
@@ -4970,4 +4973,4 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}
- \ No newline at end of file +