owasp-modsecurity / ModSecurity-nginx

ModSecurity v3 Nginx Connector
Apache License 2.0
1.56k stars 281 forks source link

Fix nginx not clearing body cache (caused by incomplete fix for #187) #217

Closed martinhsv closed 4 years ago

martinhsv commented 4 years ago

Issue 187 described a problem where the configuration setting 'client_body_in_file_only on' was not respected -- i.e. the body files were deleted despite the setting stating the file should be retained.

The original fix was to simply remove the setting of the flag in this function. This caused a side effect if no 'client_body_in_file_only' was being used, but body content was written to disk for other reasons (in this case, for exceeding client_body_buffer_size). In this case files were incorrectly retained.

The fix here is to restore the setting of 'r->request_body_in_clean_file', but to only execute it for the needed conditions.

Closes #216