Mod Security To control File Uploads to a Database

Hi

 

We have the following scenario and would appreciate some help.

 

We have a web application which accepts documents up to 5MB in size and stores them in a backend DB.

The site is functioning but problem is that an error message is not displayed when a file larger than 5MB is uploaded. The web server just doesnt process it.

 

We are not currently using mod sec to scan posts.

 

We currently have the native apache directive:

LimitRequestBody 5242880

(set to 5MB)

 

This directive, according to Apache docs, is supposed to issue an error message when limit is exceeded. But it doesnt.

 

We would like to use mod sec to perform this scan function.

 

Other than:

SecFilterDefaultAction "deny,log,status:509"
SecFilterScanPOST On

 

Where 509 is a custom message saying to user "Upload limit exceeded"

 

What additional mod sec directives are required to enforce the limit?

  Does it make a difference that the files are not loaded to disk but to db?

Thanks

 

 

---

On Yahoo!7
 
 
Messenger: Make free PC-to-PC calls to your friends overseas. 
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642_______________________________________________
mod-security-users mailing list
mod-security-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/mod-security-users