From b64dfd9792971ca7f6e24ea44e6da13768b3d273 Mon Sep 17 00:00:00 2001 From: martinhsv <55407942+martinhsv@users.noreply.github.com> Date: Thu, 13 Jan 2022 18:26:25 -0500 Subject: [PATCH] Updated Reference Manual (v3.x) (mediawiki) --- Reference-Manual-(v3.x).mediawiki | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-) diff --git a/Reference-Manual-(v3.x).mediawiki b/Reference-Manual-(v3.x).mediawiki index 4b3961d..6ea88f8 100644 --- a/Reference-Manual-(v3.x).mediawiki +++ b/Reference-Manual-(v3.x).mediawiki @@ -1684,18 +1684,10 @@ Contains the time, in microseconds, spent in audit logging. This value is known '''Supported on libModSecurity:''' TBI == PERF_PHASE1 == -Contains the time, in microseconds, spent processing phase 1. - -'''Version:''' 2.6.0-2.9.x - -'''Supported on libModSecurity:''' TBI +Not supported in v3 == PERF_PHASE2 == -Contains the time, in microseconds, spent processing phase 2. - -'''Version:''' 2.6.0-2.9.x - -'''Supported on libModSecurity:''' TBI +Not supported in v3 == PERF_PHASE3 == Not supported in v3 @@ -2031,16 +2023,7 @@ SecRule STATUS_LINE "@contains 500" "phase:3,id:49,log,pass,logdata:'Application '''Supported on libModSecurity:''' TBI == STREAM_INPUT_BODY == -'''Version:''' 2.6.0-2.9.x - -'''Supported on libModSecurity:''' No - -This variable give access to the raw request body content. This variable is best used for two use-cases: -#For fast pattern matching - using @pm/@pmf to prequalify large text strings against any kind of content-type data. This is more performant vs. using REQUEST_BODY/ARGS_POST/ARGS_POST_NAMES as it happens before ModSecurity parsing in phase:2 variable population. -#For data substitution - using @rsub against this variable allows you to manipulate live request body data. Example - to remove offending payloads or to substitute benign data. -; Note : You must enable the SecStreamInBodyInspection directive - -; Note : This directive is NOT supported for libModSecurity (v3). +Not supported in v3 == STREAM_OUTPUT_BODY == This variable give access to the raw response body content. This variable is best used for case: