github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2026-01-13 06:57:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

Added back support for HTTP_* targets by aliasing it to REQUEST_HEADERS:*.

Browse Source 
Fixed the severity warning message to only be displayed at a warn log level.
This commit is contained in:
brectanus
2008-03-19 21:31:41 +00:00
parent b2cf7d1329
commit 6b970c9185
5 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@@ -1,3 +1,9 @@
19 Mar 2008 - 2.5.1-breach1
---------------------------
* Allow HTTP_* targets as an alias for REQUEST_HEADERS:*.
14 Mar 2008 - 2.5.1 14 Mar 2008 - 2.5.1
------------------- -------------------

9
apache2/apache2_config.c
View File

@@ -1129,10 +1129,11 @@ static const char *cmd_default_action(cmd_parms *cmd, void *_dcfg, const char *p
if ((dcfg->tmp_default_actionset->severity != NOT_SET) if ((dcfg->tmp_default_actionset->severity != NOT_SET)
||(dcfg->tmp_default_actionset->logdata != NOT_SET_P)) ||(dcfg->tmp_default_actionset->logdata != NOT_SET_P))
{ {
ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_NOERRNO, 0, cmd->pool, ap_log_perror(APLOG_MARK,
"ModSecurity: WARNING SecDefaultAction \"%s\" should not " APLOG_STARTUP|APLOG_WARNING|APLOG_NOERRNO, 0, cmd->pool,
"contain a severity or logdata action (%s:%d).", "ModSecurity: WARNING Using \"severity\" or \"logdata\" in "
p1, cmd->directive->filename, cmd->directive->line_num); "SecDefaultAction is deprecated (%s:%d).",
cmd->directive->filename, cmd->directive->line_num);
} }
/* Must not use chain. */ /* Must not use chain. */

4
apache2/modsecurity.h
View File

@@ -63,8 +63,8 @@ extern DSOLOCAL modsec_build_type_rec modsec_build_type[];
#define MODSEC_VERSION_MAJOR "2" #define MODSEC_VERSION_MAJOR "2"
#define MODSEC_VERSION_MINOR "5" #define MODSEC_VERSION_MINOR "5"
#define MODSEC_VERSION_MAINT "1" #define MODSEC_VERSION_MAINT "1"
#define MODSEC_VERSION_TYPE "" #define MODSEC_VERSION_TYPE "-breach"
#define MODSEC_VERSION_RELEASE "" #define MODSEC_VERSION_RELEASE "1"
#define MODULE_NAME "ModSecurity for Apache" #define MODULE_NAME "ModSecurity for Apache"

16
apache2/re.c
View File

@@ -231,6 +231,7 @@ msre_action_metadata *msre_resolve_action(msre_engine *engine, const char *name)
msre_var *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *name, const char *param, msre_var *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *name, const char *param,
modsec_rec *msr, char **error_msg) modsec_rec *msr, char **error_msg)
{ {
const char *varparam = param;
msre_var *var = apr_pcalloc(pool, sizeof(msre_var)); msre_var *var = apr_pcalloc(pool, sizeof(msre_var));
if (var == NULL) return NULL; if (var == NULL) return NULL;
@@ -251,6 +252,17 @@ msre_var *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *
var->name = name; var->name = name;
} }
/* Treat HTTP_* targets as an alias for REQUEST_HEADERS:* */
if ( (var->name != NULL)
&& (strlen(var->name) > 5)
&& (strncmp("HTTP_", var->name, 5) == 0))
{
const char *oldname = var->name;
var->name = apr_pstrdup(pool, "REQUEST_HEADERS");
varparam = apr_pstrdup(pool, oldname + 5);
}
/* Resolve variable */ /* Resolve variable */
var->metadata = msre_resolve_var(engine, var->name); var->metadata = msre_resolve_var(engine, var->name);
if (var->metadata == NULL) { if (var->metadata == NULL) {
@@ -268,7 +280,7 @@ msre_var *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *
} }
/* Check the parameter. */ /* Check the parameter. */
if (param == NULL) { if (varparam == NULL) {
if (var->metadata->argc_min > 0) { if (var->metadata->argc_min > 0) {
*error_msg = apr_psprintf(engine->mp, "Missing mandatory parameter for variable %s.", *error_msg = apr_psprintf(engine->mp, "Missing mandatory parameter for variable %s.",
name); name);
@@ -283,7 +295,7 @@ msre_var *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *
return NULL; return NULL;
} }
var->param = param; var->param = varparam;
} }
return var; return var;

2
doc/modsecurity2-apache-reference.xml
View File

@@ -4,7 +4,7 @@
Manual</title> Manual</title>
<articleinfo> <articleinfo>
<releaseinfo>Version 2.5.1 (March 14, 2008)</releaseinfo> <releaseinfo>Version 2.5.1-breach1 (March 19, 2008)</releaseinfo>
<copyright> <copyright>
<year>2004-2008</year> <year>2004-2008</year>