diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml
index 66be3535..d40fe9f0 100644
--- a/doc/modsecurity2-apache-reference.xml
+++ b/doc/modsecurity2-apache-reference.xml
@@ -1975,11 +1975,13 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1ARGS:p will not result in any
- invocations against the operator if argument p does not exist. Some
- variables are actually collections, which are expanded into more
- variables at runtime. The following example will examine all request
- arguments:SecRule ARGS dirty
+ expression). To look at only the query string or body arguments, see the
+ ARGS_GET and ARGS_POST
+ collections.
+
+ Some variables are actually collections, which are expanded into
+ more variables at runtime. The following example will examine all
+ request arguments:SecRule ARGS dirty
Sometimes, however, you will want to look only at parts of a collection.
This can be achieved with the help of the selection
operator(colon). The following example will only look at the
@@ -2002,6 +2004,9 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1id_: SecRule ARGS:/^id_/ dirty
+ Using ARGS:p will not result in any
+ invocations against the operator if argument p does not exist.
+
In ModSecurity 1.X, the ARGS variable stood
for QUERY_STRING + POST_PAYLOAD,
whereas now it expands to to individual variables.
@@ -2036,6 +2041,37 @@ SecRule ARGS_COMBINED_SIZE "@gt 25" ARGS_NAMES "!^(p|a)$"
+
+ ARGS_GET
+
+ ARGS_GET is similar to ARGS,
+ but only contains arguments from the query string.
+
+
+
+ ARGS_GET_NAMES
+
+ ARGS_GET_NAMES is similar to
+ ARGS_NAMES, but only contains argument names from the
+ query string.
+
+
+
+ ARGS_POST
+
+ ARGS_POST is similar to
+ ARGS, but only contains arguments from the POST
+ body.
+
+
+
+ ARGS_POST_NAMES
+
+ ARGS_POST_NAMES is similar to
+ ARGS_NAMES, but only contains argument names from the
+ POST body.
+
+