Re: [mod-security-users] Blocking PUT requests

[Ivan R. <iv...@we...>]

De Vries, Richard wrote:
>
> I was wondering whether or not it'd be wise to block PUT requests. I
> don't foresee needing file-uploads ... does anyone know whether "PUT" is
> used for anything else?

  They are often used for various RPC calls, but normally not in
  "normal" web applications.


> Hmm, even though I set the following rule:
> 
>     SecFilterSelective REQUEST_METHOD "!^(GET|HEAD|POST)$"
> 
> I still see the following file being created in /tmp if I do a PUT
> 
>     /tmp/20060213-153039-172.18.60.128-request_body-TnaGyO
> 
> Additionally, these files are not automatically being cleaned up.
> Suggestions anyone?

  You should configure a different directory for those files, some place
  where only httpd can access. (Just to be on the safe side.)

  Other than that, the file is probably not erased because it is
  referenced in the audit log.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall