<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 10/16/2011 10:50 PM, Nginx User wrote:<br>
<span style="white-space: pre;">> <br>
> BTW this works fine even though it has "\":<br>
> <br>
> local query_string = ngx.re.match(ngx.var.request_uri, <br>
>
"((php|sql)-?my-?admin/|my-?(php|sql)-?admin|(php|sql)-?manager)|(_vpi|xAou6|db_name|clientrequest|option_value|sys_cpanel|db_connect|doeditconfig|check_proxy|system_user|spaw2|prx2|thisdoesnotexist|proxyjudge1|ImpEvData|proxydeny|base64|crossdomain|localhost|wwwroot|mosconfig|scanner|proc/self/environ)|\.(outcontrol|rdf|XMLHTTP|cgi|asp|aspx|cfg|dll|exe|jsp|mdb|sql|ini|rar|inc|dll)|(/admin/sqlpatch\.php/password_forgotten\.php\?action=execute)|etc/passwd|/manager/html",</span>"io")<br>
<span style="white-space: pre;"></span><br>
You're just doing "\." in that line. If Nginx strips that "\", then
it ends up in Lua as ".", which changes the meaning but will happen
to work in most cases (though it would match <span
style="white-space: pre;">sqlpatch_php</span> and other similar
strings, and not just <span style="white-space: pre;">sqlpatch.php,
since the "." will be the wildcard).</span><br>
<br>
Tim<br>
</body>
</html>