diff --git a/CHANGES b/CHANGES index f4a6377..43f3052 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ +v1.0.4 - 2024-May-29 +-------------------- + + - Fix request logging false positives due to error_page internal redirects and improve performance by not evaluating again post redirect + [Issue #182 - @jeremyjpj0916] + v1.0.3 - 2022-May-24 -------------------- @@ -17,7 +23,7 @@ v1.0.2 - 2021-Jun-02 [Issue #216 - @krewi1, @martinhsv] - Fix config setting not respected: client_body_in_file_only on [Issue #187 - @martinhsv] - - Fix audit_log not generated for disruptive actions + - Fix audit_log not generated for disruptive actions [Issue #170, #2220, #2237 - @victorhora] - Exit more gracefully if uri length is zero [@martinhsv] @@ -27,7 +33,7 @@ v1.0.1 - 2019-Dec-16 - Fixed obtaining of server_addr [Issue #167, #168 - @defanator] - - Avoid processing of subrequests initiated by the error_page + - Avoid processing of subrequests initiated by the error_page [Issue #76, #164, #165 - @defanator] - Tests: extend request body tests [Issue #142,#143 - @defanator] @@ -67,4 +73,3 @@ v1.0.0 - 2017-Dec-20 -------------------- - First version of ModSecurity-nginx connector - diff --git a/src/ngx_http_modsecurity_pre_access.c b/src/ngx_http_modsecurity_pre_access.c index ea5c021..98d8fff 100644 --- a/src/ngx_http_modsecurity_pre_access.c +++ b/src/ngx_http_modsecurity_pre_access.c @@ -50,6 +50,11 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r) ngx_http_modsecurity_ctx_t *ctx; ngx_http_modsecurity_conf_t *mcf; + + if (r->error_page) { + return NGX_DECLINED; + } + dd("catching a new _preaccess_ phase handler"); mcf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module); @@ -227,4 +232,3 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r) #endif return NGX_DECLINED; } - diff --git a/src/ngx_http_modsecurity_rewrite.c b/src/ngx_http_modsecurity_rewrite.c index 926cf70..a236abb 100644 --- a/src/ngx_http_modsecurity_rewrite.c +++ b/src/ngx_http_modsecurity_rewrite.c @@ -29,6 +29,11 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r) ngx_http_modsecurity_ctx_t *ctx; ngx_http_modsecurity_conf_t *mcf; + + if (r->error_page) { + return NGX_DECLINED; + } + mcf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module); if (mcf == NULL || mcf->enable != 1) { dd("ModSecurity not enabled... returning"); @@ -227,4 +232,4 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r) return NGX_DECLINED; -} +} \ No newline at end of file