From 6809b4094659e29e2d5de44a9df51b7d7ec7596a Mon Sep 17 00:00:00 2001 From: b1v1r Date: Mon, 3 Aug 2009 18:52:19 +0000 Subject: [PATCH] Add "phase:1" to all initcol examples (MODSEC-80). --- doc/modsecurity2-apache-reference.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 76c815c0..e0ca08b9 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -6,7 +6,7 @@ Manual - Version 2.5.10-dev1 (July 27, 2009) + Version 2.5.10 (Aug 3, 2009) 2004-2009 @@ -533,7 +533,7 @@ LoadFile /usr/lib/liblua5.1.so Example Usage: SecAction - nolog,initcol:RESOURCE=%{REQUEST_FILENAME} + nolog,phase:1,initcol:RESOURCE=%{REQUEST_FILENAME} Processing Phase: Any @@ -4753,10 +4753,14 @@ setvar:session.suspicious=1,expirevar:session.suspicious=3600Example: The following example initiates IP address tracking. - SecAction initcol:ip=%{REMOTE_ADDR},nolog + SecAction phase:1,initcol:ip=%{REMOTE_ADDR},nolog Note + Normally you will want to use phase:1 + along with initcol so that the collection is + available in all phases. + Collections are loaded into memory when the initcol action is encountered. The collection in storage will be persisted (and the appropriate counters increased) only if it was @@ -4775,7 +4779,7 @@ setvar:session.suspicious=1,expirevar:session.suspicious=3600Example: - SecAction initcol:ip=%{REMOTE_ADDR},log + SecAction phase:1,initcol:ip=%{REMOTE_ADDR},log Note