Apache mod-security

Eli | 2 Nov 22:52

Add SCRIPT_NAME to known CGI variables?

I was looking for a CGI variable which contained only the path of the script
called in the URI, minus the DOCUMENT_ROOT.  Apparently both
REQUEST_FILENAME and SCRIPT_FILENAME are the full script path on the server,
and the only CGI variable I can find that would be those, minus the
DOCUMENT_ROOT, is SCRIPT_NAME, but it isn't accepted (1.9RC1 being used).

Is there any reason this CGI variable is not allowed in mod_security?  If so
what is it?  If not, would a patch submitted adding it be accepted (pending
proper coding techniques and testing obviously)?

Eli.

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php

headers

Ivan Ristic | 3 Nov 11:38

Re: Add SCRIPT_NAME to known CGI variables?

Eli wrote:
> I was looking for a CGI variable which contained only the path of the script
> called in the URI, minus the DOCUMENT_ROOT.  Apparently both
> REQUEST_FILENAME and SCRIPT_FILENAME are the full script path on the server,
> and the only CGI variable I can find that would be those, minus the
> DOCUMENT_ROOT, is SCRIPT_NAME, but it isn't accepted (1.9RC1 being used).
> 
> Is there any reason this CGI variable is not allowed in mod_security?

  There is no particular reason for that - I simply missed the variable. I'll
  add it to the TODO list for the next release.

--

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php

headers

Eli | 5 Nov 21:14

RE: Add SCRIPT_NAME to known CGI variables?

Ivan wrote:
> There is no particular reason for that - I simply missed the
> variable. I'll add it to the TODO list for the next release.

Ah, awesome :)  Saves me writing a patch for it.  Thanks!

Eli.

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php