diff --git a/Reference-Manual.mediawiki b/Reference-Manual.mediawiki index 44b2e6f..e1e6a51 100644 --- a/Reference-Manual.mediawiki +++ b/Reference-Manual.mediawiki @@ -1498,7 +1498,7 @@ SecRule REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \ SecRuleUpdateTargetById 958895 REQUEST_URI REQUEST_FILENAME -The effective resulting rule in the previous example will append the target to the end of the variable list as follows: +The effective resulting rule in the previous example replaces the target in the begin of the variable list as follows:
SecRule REQUEST_URI|ARGS_NAMES|ARGS|XML:/* "[\;\|\`]\W*?\bmail\b" \ "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%