mod-security-users

[mod-security-users] RE: mod-security-users digest, Vol 1 #127 - 5 msgs

[Tkachenko A. <al...@tk...>]

>> * Reject Cross site scripting attacks

Can anybody give a good example?
Especially for:
	I have many requests like
http://URL?PARAMETER=http://atackersite/atackerpage&ANOTHERPARAMETER
where "http://atackersite/atackerpage" load some bad script from
outside.
	I can not block them by "=http://" filter because much clients
use such form in their work.

>> I will release 1.8.6 early next week to fix another
>>  small issue that has just popped up.

My opinion: too hard to be updated so often.



Alexey.

Re: [mod-security-users] RE: mod-security-users digest, Vol 1 #127 - 5 msgs

[Ivan R. <iv...@we...>]

>>>I will release 1.8.6 early next week to fix another
>>> small issue that has just popped up.
> 
> My opinion: too hard to be updated so often.

  You don't need to upgrade every time there's a minor update
  available. Minor problems affect a small number of users,
  and they are usually discovered in parts of the code that
  are not used often.

  But if you are affected, the good news is you can.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

RE: [mod-security-users] RE: mod-security-users digest, Vol 1 #127 - 5 msgs

[Tkachenko A. <al...@tk...>]

Thank you.

-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: Friday, October 29, 2004 00:26
To: Tkachenko Alexei
Cc: mod...@li...
Subject: Re: [mod-security-users] RE: mod-security-users digest, Vol 1
#127 - 5 msgs



>>>I will release 1.8.6 early next week to fix another
>>> small issue that has just popped up.
> 
> My opinion: too hard to be updated so often.

  You don't need to upgrade every time there's a minor update
  available. Minor problems affect a small number of users,
  and they are usually discovered in parts of the code that
  are not used often.

  But if you are affected, the good news is you can.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]