Re: Setting a request header to value from POST data

Hi Christian,

yes that's what I thought as well - and oh yes, I had capture in my
statement also for most of the time, it just disappeared in my quoted
example as I tried many different approaches.
What's even more confusing is that the following example doesn't work
either:

      SecRule ARGS:MERCHANTID "(.*)"
"phase:2,id:81104,capture,setenv:PMID=12345,pass"
      RequestHeader set POSTMERCHANTID "%{PMID}e"

I get "(null)" every time (which would have been avoided with "env=PMID" in
RequestHeader) instead of 12345...


Thanks,
Andres

-----Ursprüngliche Nachricht-----
Von: Christian Folini <[email protected]> 
Gesendet: Freitag, 23. August 2019 12:23
An: [email protected]
Betreff: Re: [mod-security-users] Setting a request header to value from
POST data

Hey Andres,

On Fri, Aug 23, 2019 at 09:48:38AM +0000, Andres Ofner wrote:
> In code, I came up with this:
> 
>       SecRule ARGS:MERCHANTID "(\d+)"
> "phase:2,id:81104,setenv:PMID=%{TX.0},pass"
> 
>       RequestHeader set POSTMERCHANTID "%{PMID}e" env=PMID


This should work when done correctly. (The order of the hooks / modules does
allow for it). Please try and add the "capture" action. This should do the
trick. If not, then you shoudl raise the debug log level to 9 and follow the
execution carefully.

> Also, I wonder why I failed to increase logging for 200 responses 
> which by default are excluded, when adding these to the SecRule:
> 
> log,auditlog,ctl:auditEngine=On,ctl:auditLogParts=+E,ctl:debugLogLevel
> =9

Not sure. I think it ought to log the request to the auditlog. Otherwise
raise the baseline debug log level to 9 and look at the rule execution
carefully. Is there really a match, etc. auditEngine=on should not be needed
here, btw.

Cheers,

Christian


--
We used to think that if we knew one, we knew two, because one and one are
two. We are finding that we must learn a great deal more about 'and'.
-- Sir Arthur Eddington


_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/