Re: [mod-security-users] Setenv and checking ENV_

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi, i'm having problems with the Setenv action, i want to set an 
> enviroment variable like test=1, and then in another rule check if it is 
> set, but can't get it done, here is what i do:

   Just use the debug log to figure out.


> SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass
> 
> And then
> 
> <Location /admin/toprotect.asp>
> SecFilterSelective ENV_test  "1"  log,pass
> </Location>
> 
> I first access my example.asp, and then  /admin/toprotect.asp, but 
> doesn't work..
> 
> Any ideas?

   I suspect this is what happens after inheritance takes place:

   SecFilterSelective ENV_test  "1"  log,pass
   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass

   In 1.9.x the following should happen:

   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass
   SecFilterSelective ENV_test  "1"  log,pass

   ...

   As a temporary workaround in 1.8.x you may want to use SetEnvIf
   to set the variable.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org