modsecurity | 2 May 10:12

Disable rule by requested file

Hi everyone,

maybe i missed something, but I cant get it to work:

An automated process requests the URL /schedule.php on our severs  
which triggers rule 990011, so we want to disable this specific core  
rule (990011) for this file.

SecRule REQUEST_LINE "@contains schedule"  
"phase:1,nolog,pass,ctl:ruleRemoveById=990011"

wont work (also @contains schedule.php and @contains schedule\.php dont work.)

SecRule REQUEST_LINE "@contains .php"  
"phase:1,nolog,pass,ctl:ruleRemoveById=990011"

works.

Any hint on the difference?

Thanks in advance,
Best regards,
Thomas

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
(Continue reading)


Gmane