apache - Updating an arugement of a ModSecurity Core Rule -

-

i have big form needs send 1000 post data arguments @ most. triggers false alarm rule 960335 of owasp core rulset. looked rule in modsecurity_crs_23_request_limits.conf can't figure out how set max_num_args higher on specific form.

in modsecurity_crs_60_customrules.conf, have tried:

<locationmatch "/form.php">     secruleupdatetargetbyid 960335 args:"@gt %1000"  </locationmatch>

but syntax check gave me error 

`updating target id no ruleset in context`

can tell me how set max_num_args higher?

here's rule 960335:

secrule &tx:max_num_args "@eq 1" "chain,phase:2,t:none,block, msg:'too many arguments in request',id:'960335', severity:'4',rev:'2',ver:'owasp_crs/2.2.9',maturity:'9', accuracy:'9',tag:'owasp_crs/policy/size_limit'"  secrule &args "@gt %{tx.max_num_args}" "t:none,setvar:'tx.msg=%{rule.msg}', setvar:tx.anomaly_score=+%{tx.notice_anomaly_score}, setvar:tx.%{rule.id}-owasp_crs/policy/size_limit-%{matched_var_name}=%{matched_var}"

this set in modsecurity_crs_10_setup.conf file:

# -- maximum number of arguments in request limited secaction \   "id:'900006', \   phase:1, \   t:none, \   setvar:tx.max_num_args=255, \   nolog, \   pass"

Comments

Post a Comment

Popular posts from this blog

php - Admin SDK -- get information about the group -

-
please, help. https://www.googleapis.com/admin/directory/v1/groups/106274944935548788283 sending request obtain information group id 1062 ... here link method in google https://developers.google.com/admin-sdk/directory/v1/guides/manage-groups#get_group in response error - 401 unauthorized. oauth authenticate via user has received rights necessary request, included in console admin sdk. authorization successful, there token. not can not understand. if not hard - response. requested information: file_get_contents("https://www.googleapis.com/admin/directory/v1/groups/1062749‌​44935548788283?key=aizasybruhiomdf9nlx9lx3imxwesqmcrnhh4l4"); id group - "106274944935548788283" key applications in case - "aizasybruhiomdf9nlx9lx3imxwesqmcrnhh4l4" error: failed open stream: http request failed! http/1.0 401 unauthorized
Read more

dns - How To Use Custom Nameserver On Free Cloudflare? -

-
i have problem. i own small hosting company. trying add cloudflare site free cdn. problem when sign have change nameservers nameservers. have nameserver dns set through godaddy, how add them cloudflare? main site uses company's nameservers whenever add them site goes offline. when go cloudflare's dns records click on dropdown, click ns, , there's 2 boxes 'name' , 'nameserver'. mean input 'ns1' 'name' , 'ns1.domain.com' 'nameserver'? input server's ip addresses? is there way of accomplishing free version of cloudflare? that impossible. option have custom name servers available on business , enterprise. see https://www.cloudflare.com/plans . also, might mistaken. must change name servers in domain register settings, not on cloudflare.
Read more

Python Error - TypeError: input expected at most 1 arguments, got 3 -

-
can explain why can not use your_name in goal variable? my_name = "bryson" my_age = 29 your_name = input ("what name? ") your_age = input ("what age? ") print ("my name is", my_name,", , am", my_age, "years old.") print ("your name is", your_name,", , are", your_age,".") print("thank buying book,", your_name,"!") goal = input ("what favorite part of book,", your_name, "?") print("awesome!") the error is: goal = input ("what favorite part of book,", your_name, "?") typeerror: input expected @ 1 arguments, got 3 you got error because in fact gave 3 arguments input function when expecting 1 (namely, string prompt). in input ("what favorite part of book,", your_name, "?") ---------------------------------------- , ---------, --- the underlined parts comma-separated arguments: st...
Read more