requestclassifier.ini [RuleSet-injection] #

The block [RuleSet-injection] of settings/requestclassifier.ini, with 3 setting(s).

Never edit settings/requestclassifier.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/requestclassifier.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/requestclassifier.ini.append.php for one siteaccess,
• extension/<extension>/settings/requestclassifier.ini.append.php in an extension (read when the extension is active).

Class #

Matched against the query and the path, decoded once; a posted body is never looked at. Rules: sql-union,
sql-tautology (' or '1'='1), sql-boolean (or 1=1--), sql-time (sleep(, benchmark(), sql-schema
(information_schema), sql-stacked (;drop table), sql-function, cmd-file (/etc/passwd), cmd-chain (;id, |cat, $(...),
backticks), jndi, ssti ({{7*7}}, ${7*7}, #{...}, <%= %>), xss-script (<script, %3Cscript), xss-event (onerror=,
<svg/on...), xss-url (javascript:), php-code.
A search for "union station", O'Reilly, "select or drop" or is no injection.

Default: empty.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[RuleSet-injection]
Class=
*/ ?>

Patterns #

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[RuleSet-injection]
# an empty "Patterns[]" first replaces the shipped list; without it the items are added
Patterns[]
*/ ?>

Disabled #

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[RuleSet-injection]
# an empty "Disabled[]" first replaces the shipped list; without it the items are added
Disabled[]
*/ ?>

Related #

• All blocks of requestclassifier.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/requestclassifier.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.