Re: [mod-security-users] ruleRemoveTargetByTag - am I misunderstanding how it works?

[Eirik Ø. - M. <ltn...@an...>]

All,

> On 5 Apr 2018, at 16:19, Eirik Øverby - ModSecurity <ltn...@an...> wrote:
...
> SecRule REQUEST_URI "@beginsWith /mdpayacs/pareq" \
>    "phase:1,id:1003,t:none,pass,nolog,chain,\
>        ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:TermURL,\
>        ctl:ruleRemoveTargetByTag=attack-rce;ARGS:TermURL,\
>        ctl:ruleRemoveTargetByTag=attack-xss;ARGS:TermURL"
>            SecRule ARGS:TermURL "@beginsWith http" "t:none"

before anyone comments - yes, I modified this to say phase:2 - does not make any difference..

/Eirik