Merge pull request #1738 from lifeforms/wordpress-urls

WordPress: exclude additional URL fields in profile editor
SpiderLabs · May 4, 2020 · 20d04d3 · 20d04d3
2 parents f1f7595 + b687960
commit 20d04d3
Showing 1 changed file with 16 additions and 1 deletion.
diff --git a/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf b/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
@@ -292,9 +292,14 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/profile.php" \
             "t:none,\
             ctl:ruleRemoveTargetById=931130;ARGS:url,\
             ctl:ruleRemoveTargetById=931130;ARGS:facebook,\
-            ctl:ruleRemoveTargetById=931130;ARGS:googleplus,\
             ctl:ruleRemoveTargetById=931130;ARGS:instagram,\
             ctl:ruleRemoveTargetById=931130;ARGS:linkedin,\
+            ctl:ruleRemoveTargetById=931130;ARGS:myspace,\
+            ctl:ruleRemoveTargetById=931130;ARGS:pinterest,\
+            ctl:ruleRemoveTargetById=931130;ARGS:soundcloud,\
+            ctl:ruleRemoveTargetById=931130;ARGS:tumblr,\
+            ctl:ruleRemoveTargetById=931130;ARGS:youtube,\
+            ctl:ruleRemoveTargetById=931130;ARGS:wikipedia,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"
@@ -313,6 +318,16 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-edit.php" \
         SecRule &ARGS:action "@eq 1" \
             "t:none,\
             ctl:ruleRemoveTargetById=931130;ARGS:url,\
+            ctl:ruleRemoveTargetById=931130;ARGS:url,\
+            ctl:ruleRemoveTargetById=931130;ARGS:facebook,\
+            ctl:ruleRemoveTargetById=931130;ARGS:instagram,\
+            ctl:ruleRemoveTargetById=931130;ARGS:linkedin,\
+            ctl:ruleRemoveTargetById=931130;ARGS:myspace,\
+            ctl:ruleRemoveTargetById=931130;ARGS:pinterest,\
+            ctl:ruleRemoveTargetById=931130;ARGS:soundcloud,\
+            ctl:ruleRemoveTargetById=931130;ARGS:tumblr,\
+            ctl:ruleRemoveTargetById=931130;ARGS:youtube,\
+            ctl:ruleRemoveTargetById=931130;ARGS:wikipedia,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
             ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"