From 22ac7e9325b67c8aa96174b47a61960fbb3127f3 Mon Sep 17 00:00:00 2001 From: Andrew Lewis Date: Tue, 29 Nov 2016 18:29:52 +0200 Subject: [PATCH] [Minor] Remove duplicated rule --- rules/regexp/compromised_hosts.lua | 4 ++-- rules/regexp/headers.lua | 7 ------- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua index e5e6e6aec..8d224b315 100644 --- a/rules/regexp/compromised_hosts.lua +++ b/rules/regexp/compromised_hosts.lua @@ -83,10 +83,10 @@ reconf['HAS_X_ANTIABUSE'] = { group = "compromised_hosts" } -reconf['PHP_EVALD_CODE'] = { +reconf['X_PHP_EVAL'] = { re = "X-PHP-Script=/eval\\(\\)\\'d/Hi || X-PHP-Originating-Script=/eval\\(\\)\\'d/Hi", description = "Message sent using eval'd PHP", - score = 5.0, + score = 4.0, group = "compromised_hosts" } diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua index 5118a5b9b..d05874809 100644 --- a/rules/regexp/headers.lua +++ b/rules/regexp/headers.lua @@ -785,13 +785,6 @@ reconf['INVALID_POSTFIX_RECEIVED'] = { group = 'header' } -reconf['X_PHP_EVAL'] = { - re = "X-PHP-Originating-Script=/ : eval\\(\\)'d code$/X", - score = 4.0, - description = "Message sent by eval()'d PHP code", - group = 'header' -} - reconf['X_PHP_FORGED_0X'] = { re = "X-PHP-Originating-Script=/^0\\d/X", score = 4.0, -- 2.39.5