From a71b58417af9380ceb9d253104c8bf7147ada963 Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Mon, 19 Jun 2017 18:32:17 -0300
Subject: [PATCH] Duplicates the url variable in the disruptive action

The log message needs to be freed by the consumer. Doing the same with
the url to keep the API consistent.
---
 src/transaction.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/transaction.cc b/src/transaction.cc
index c786c4ae..343c4411 100644
--- a/src/transaction.cc
+++ b/src/transaction.cc
@@ -1293,7 +1293,9 @@ int Transaction::processLogging() {
  */
 bool Transaction::intervention(ModSecurityIntervention *it) {
     if (m_it.disruptive) {
-        it->url = m_it.url;
+        if (m_it.url) {
+            it->url = strdup(m_it.url);
+        }
         it->disruptive = m_it.disruptive;
         it->status = m_it.status;