[mod-security-users] checking single parameter value
Brought to you by:
victorhora,
zimmerletw
|
From: joe b. <joe...@ya...> - 2006-04-13 01:56:36
|
Hello list; In my debug log I see this: Normalised REQUEST_URI: /mls_verifyemail.php?hash=bGF5YmFja2ppbW15 Parsing arguments... Adding parameter: [hash][bGF5YmFja2ppbW15] Checking signature "^/mls_verifyemail.php" at REQUEST_URI Checking against "/mls_verifyemail.php?hash=bGF5YmFja2ppbW15" Signature check returned -1 Access allowed based on pattern match "^/mls_verifyemail.php" at REQUEST_URI This is the rule which allows the above to pass SecFilterSelective REQUEST_URI "^/mls_verifyemail.php" allow I want to tighten this up by checking that there is only a single parameter value and that its a md5 hash with no bogus stuff inserted SecFilterSelective REQUEST_URI "^/mls_verifyemail.php" chain SecFilterSelective QUERY_STRING "^?hash=" chain SecFilterSelective ARGS_VALUES "^hash=[0-9a-zA-Z]" allow This errors out. What am I doing wrong? --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big. |