diff --git a/CHANGES b/CHANGES
index 47e31409..6114d98c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,14 +1,8 @@
-?? ??? 2007 - 2.5.0-trunk
--------------------------
+?? ??? 2007 - 2.5.0-dev3
+------------------------
* Used new API calls to get the server version/banner when available.
- * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity.
-
- * Quiet some compiler warnings.
-
- * Added ability to compile without an external API (-DNO_MODSEC_API).
-
* Added "logdata" meta action to allow safe logging of raw transaction data.
* Added TX_SEVERITY that keeps track of the highest severity
@@ -35,8 +29,23 @@
visibility attribute.
-27 July 2007 - 2.1.2
---------------------
+11 Sep 2007 - 2.1.3
+-------------------
+
+ * Updated multipart parsing code adding variables to allow checking
+ for various parsing issues (request body abnormalities).
+
+ * Allow mod_rpaf and mod_extract_forwarded2 to work before ModSecurity.
+
+ * Quiet some compiler warnings.
+
+ * Do not block internal ErrorDocument requests after blocking request.
+
+ * Added ability to compile without an external API (use -DNO_MODSEC_API).
+
+
+27 Jul 2007 - 2.1.2
+-------------------
* Cleaned up and clarified some documentation.
diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h
index 6afadc77..4daa9bca 100644
--- a/apache2/modsecurity.h
+++ b/apache2/modsecurity.h
@@ -58,8 +58,8 @@ extern DSOLOCAL modsec_build_type_rec modsec_build_type[];
#define MODSEC_VERSION_MAJOR "2"
#define MODSEC_VERSION_MINOR "5"
#define MODSEC_VERSION_MAINT "0"
-#define MODSEC_VERSION_TYPE "trunk"
-#define MODSEC_VERSION_RELEASE "99"
+#define MODSEC_VERSION_TYPE "dev"
+#define MODSEC_VERSION_RELEASE "3"
#define MODULE_NAME "ModSecurity"
#define MODULE_RELEASE \
diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml
index 85dc4c75..3e078508 100644
--- a/doc/modsecurity2-apache-reference.xml
+++ b/doc/modsecurity2-apache-reference.xml
@@ -3,7 +3,7 @@
ModSecurity Reference Manual
- Version 2.5.0-trunk / (September 7, 2007)
+ Version 2.5.0-dev3 / (September 14, 2007)
2004-2007
@@ -666,9 +666,9 @@ SecAuditLogStorageDir logs/audit
I - This part is a
replacement for part C. It will log the same data as C in all cases
- except whenmultipart/form-data
+ except when multipart/form-data
encoding in used. In this case it will log a fake application/x-www-form-urlencoded body
+ moreinfo="none">application/x-www-form-urlencoded body
that contains the information about parameters but not about the
files. This is handy if you don't want to have (often large) files
stored in your audit logs.
@@ -677,7 +677,7 @@ SecAuditLogStorageDir logs/audit
J - RESERVED. This part,
when implemented, will contain information about the files uploaded
- using multipart/form-data encoding.
+ using multipart/form-data encoding.
@@ -1910,16 +1910,17 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1
- application/x-www-form-urlencoded - used to transfer form
- data
-
-
-
- multipart/form-data - used for file transfers
-
-
-
- text/xml - used for passing XML data
+ application/x-www-form-urlencoded - used to
+ transfer form data
+
+
+
+ multipart/form-data - used for file
+ transfers
+
+
+
+ text/xml - used for passing XML data
@@ -3694,7 +3695,7 @@ SecRule REQUEST_URI "^/cgi-bin/script\.pl" \
- 1 - 99,999; reserved for local (internal) use. Use as you see
+ 1-99,999; reserved for local (internal) use. Use as you see
fit but do not use this range for rules that are distributed to
others.
@@ -4730,10 +4731,11 @@ SecRule REQUEST_HEADERS:Ip-Address "!@streq %{TX.1}
+ check byte range in a POST payload when
+ multipart/form-data encoding (file upload) is used.
+ Doing so would prevent binary files from being uploaded. However, after
+ the parameters are extracted from such request they are checked for a
+ valid range.
validateByteRange is similar to the ModSecurity 1.X
SecFilterForceByteRange Directive however since it works in a rule
@@ -4804,8 +4806,9 @@ SecRule XML "@validateSchema /path/to/apache2/conf/xml.xsd
URL encoding is an HTTP standard for encoding byte values within a
URL. The byte is escaped with a % followed by two hexadecimal values
(0-F). This directive does not check encoding in a POST payload when the
- multipart/form-data encoding (file upload) is used. It is not necessary
- to do so because URL encoding is not used for this encoding.
+ multipart/form-data encoding (file upload) is used.
+ It is not necessary to do so because URL encoding is not used for this
+ encoding.
@@ -4970,4 +4973,4 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}
-
\ No newline at end of file
+