diff --git a/CHANGES b/CHANGES index c1baac52ea..0fc51c7feb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ v3.x.y - YYYY-MMM-DD (to be released) ------------------------------------- + - Fix: FILES variable does not use multipart part name for key + [Issue #2377 - @martinhsv] - GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE [Issues #2378, #2186 - @defanator] - rx: exit after full match (remove /g emulation); ensure capture diff --git a/src/request_body_processor/multipart.cc b/src/request_body_processor/multipart.cc index 032cfd3c61..8baf1ceefc 100644 --- a/src/request_body_processor/multipart.cc +++ b/src/request_body_processor/multipart.cc @@ -1135,7 +1135,7 @@ int Multipart::multipart_complete(std::string *error) { name.assign(m->m_filename); } - m_transaction->m_variableFiles.set(m->m_filename, + m_transaction->m_variableFiles.set(m->m_name, m->m_filename, m->m_filenameOffset); m_transaction->m_variableFilesNames.set(m->m_name, diff --git a/test/test-cases/regression/variable-FILES.json b/test/test-cases/regression/variable-FILES.json index e426ab7bfb..7f0f4dcf56 100644 --- a/test/test-cases/regression/variable-FILES.json +++ b/test/test-cases/regression/variable-FILES.json @@ -2,7 +2,7 @@ { "enabled":1, "version_min":300000, - "title":"Testing Variables :: FILES (1/1)", + "title":"Testing Variables :: FILES (1/2)", "client":{ "ip":"200.249.12.31", "port":123 @@ -57,5 +57,64 @@ "SecRuleEngine On", "SecRule FILES \"@contains small_text_file.txt\" \"id:1,phase:3,pass,t:trim\"" ] + }, + { + "enabled":1, + "version_min":300000, + "title":"Testing Variables :: FILES (2/2)", + "client":{ + "ip":"200.249.12.31", + "port":123 + }, + "server":{ + "ip":"200.249.12.31", + "port":80 + }, + "request":{ + "headers":{ + "Host":"localhost", + "User-Agent":"curl/7.38.0", + "Accept":"*/*", + "Content-Length":"330", + "Content-Type":"multipart/form-data; boundary=--------------------------756b6d74fa1a8ee2", + "Expect":"100-continue" + }, + "uri":"/", + "method":"POST", + "body":[ + "----------------------------756b6d74fa1a8ee2", + "Content-Disposition: form-data; name=\"name\"", + "", + "test", + "----------------------------756b6d74fa1a8ee2", + "Content-Disposition: form-data; name=\"filedata1\"; filename=\"myfile.txt\"", + "Content-Type: text/plain", + "", + "This is a very small test file..", + "----------------------------756b6d74fa1a8ee2", + "Content-Disposition: form-data; name=\"filedata2\"; filename=\"nextfile.txt\"", + "Content-Type: text/plain", + "", + "This is another very small test file..", + "----------------------------756b6d74fa1a8ee2--" + ] + }, + "response":{ + "headers":{ + "Date":"Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type":"text/html" + }, + "body":[ + "no need." + ] + }, + "expected":{ + "http_code": 403 + }, + "rules":[ + "SecRuleEngine On", + "SecRule FILES:filedata1 \"@contains myfile.txt\" \"id:1,phase:2,deny,status:403\"" + ] } ]