diff --git a/apache2/apache2_io.c b/apache2/apache2_io.c index 88b34c3e..980acaf3 100644 --- a/apache2/apache2_io.c +++ b/apache2/apache2_io.c @@ -260,6 +260,11 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) { *error_msg = apr_psprintf(msr->mp, "Request body is larger than the " "configured limit (%ld).", msr->txcfg->reqbody_limit); + } else if ((msr->txcfg->is_enabled == MODSEC_DETECTION_ONLY) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)){ + + *error_msg = apr_psprintf(msr->mp, "Request body is larger than the " + "configured limit (%ld).", msr->txcfg->reqbody_limit); + } else { *error_msg = apr_psprintf(msr->mp, "Request body is larger than the " @@ -299,8 +304,6 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) { if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) return -1; - if((msr->txcfg->is_enabled == MODSEC_DETECTION_ONLY) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) - return -1; } } diff --git a/apache2/msc_reqbody.c b/apache2/msc_reqbody.c index 7923b3e9..d9b01824 100644 --- a/apache2/msc_reqbody.c +++ b/apache2/msc_reqbody.c @@ -361,9 +361,22 @@ apr_status_t modsecurity_request_body_store(modsec_rec *msr, /* Check that we are not over the request body no files limit. */ if (msr->msc_reqbody_no_files_length >= (unsigned long) msr->txcfg->reqbody_no_files_limit) { + + *error_msg = apr_psprintf(msr->mp, "Request body no files data length is larger than the " + "configured limit (%ld).", msr->txcfg->reqbody_no_files_limit); + if (msr->txcfg->debuglog_level >= 4) { + msr_log(msr, 4, "%s", *error_msg); + } + + if ((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) { return -5; + } else if (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_PARTIAL) { + if(msr->txcfg->is_enabled == MODSEC_ENABLED) + return -5; + } } + /* Store data. */ if (msr->msc_reqbody_storage == MSC_REQBODY_MEMORY) { return modsecurity_request_body_store_memory(msr, data, length, error_msg);