Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of dirkx@webweaving.org designates
 178.18.23.51 as permitted sender)
From: Dirk-Willem van Gulik <dirkx@webweaving.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: Advisory improvement
Date: Fri, 26 Aug 2011 12:34:48 +0100
Message-Id: <74851D2E-825C-4A39-AF5E-88961872034A@webweaving.org>
To: dev@httpd.apache.org
Mime-Version: 1.0 (Apple Message framework v1244.3)

=46rom the Full Disclosure list. Does anyone have time to confirm this =
improvement.

On 26 Aug 2011, at 12:09, Carlos Alberto Lopez Perez wrote:
> RewriteEngine on
> RewriteCond %{HTTP:range} !(^bytes=3D[^,]+(,[^,]+){0,4}$|^$) [NC,OR]
> RewriteCond %{HTTP:request-range} !(^bytes=3D[^,]+(,[^,]+){0,4}$|^$) =
[NC]
> RewriteRule .* - [F]
>=20
> Because if you don't specify the [OR] apache will combine the rules
> making an AND (and you don't want this!).
>=20
> Also use NC=3D(nocase) to prevent the attacker upper casing "bytes=3D"
> (don't know if it will work.. but just to prevent)

Pretty Please !

Thanks,

Dw.