Re: [mod-security-users] mod_security status 200

[Ivan R. <iv...@we...>]

Peter VE wrote:
> Ok, I forgot to turn on SecFilterScanOutput
> 
>     SecFilterScanOutput On
>     SecFilterSelective OUTPUT "was not found on this server." status:200
> 
> After enabling ScanOutput, I'm seeing "scan_pre: adding the output
> filter to the filter list" in the log... but it still doesn't work
> 
> any ideas ?

  Actually, the output filter is not triggered for Apache-produced
  pages. (I'll have to look into that to figure out exactly why.)
  So the above only works for "normal" pages.

  But there is another way. Do this:

  ErrorDocument 404 /error404.php

  And then have the script explicitly respond with code 200
  in addition to outputing a human-readable message.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org