diff --git a/CHANGES b/CHANGES index e0f13017..6aac54dd 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ ?? ???? ???? - 2.1.3-rc1 ------------------------ + * Do not block internal ErrorDocument requests. + * Added ability to compile without an external API (-DNO_MODSEC_API). diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c index e0eeb21a..265152d1 100644 --- a/apache2/mod_security2.c +++ b/apache2/mod_security2.c @@ -583,6 +583,13 @@ static int hook_request_late(request_rec *r) { /* Has this phase been completed already? */ if (msr->phase_request_body_complete) { + /* If we are redirecting and there was no previous response it is + * an error page request and we ignore it. + */ + if ((msr->r->prev != NULL) && (msr->r->prev->headers_out == NULL || apr_is_empty_table(msr->r->prev->headers_out))) { + msr_log(msr, 9, "Allowing internally redirected error document: %s", msr->r->uri); + return DECLINED; + } if (msr->was_intercepted) { msr_log(msr, 4, "Phase REQUEST_BODY request already intercepted. Intercepting additional request."); return perform_interception(msr);