Re: [mod-security-users] ModSecurity 2.9.2 Rule Processing Order

[Gryzli B. <gry...@gm...>]

Actually it makes sense to work the way it does, it is my fault that I 
lived with wrong assumptions for so long ..

Thanks again ;)

On 12/12/18 3:27 PM, Reindl Harald wrote:
>
> Am 12.12.18 um 14:21 schrieb Gryzli Bugbear:
>> Thanks for your reply Reindl!
>>
>> Could you tell me what do you mean by this:
>>> the rule-ids are in different ranges depedning of context
>> Just to make it clear - I'm using my own rules (not the CRS).
>>
>> Also I didn't find any section in the official documentation stating the
>> rule execution order (for a same phase) is actually based no the order
>> they are stored in config files, instead of the id
> in the past the rule-id wasn't mandatory at all, that changed a few
> years ago
>
> executing in id-order wouldn't be helpful
>
> have fun when you have SecRuleRemoveById like below which can also exist
> in a <VirtualHost> and need to change ordering
>
> <LocationMatch "^/whatever$">
>   SecRuleRemoveById 132
>   SecRuleRemoveById 152
>   SecRuleRemoveById 958086
>   SecRuleRemoveById 958087
>   SecRuleRemoveById 950107
> </LocationMatch>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
-- 
-- Gryzli

https://gryzli.info