# The fifteenth change: on Forgejo's paths, some fields skip the rules that
# refused ordinary Forgejo requests there. Forgejo is a fork of gitea, and the
# eighth change's fixes for gitea apply to its requests too, so this file holds
# only what Forgejo sends and gitea does not. Each exclusion runs with the
# request, before the rules it switches off, so this file is loaded before the
# Core Rule Set's rules. Each comment names a request the rule refused.

# Forgejo's search of a wiki sends the text searched for in q, which skips
# these rules there:
#   930120: .htaccess
#   932120: powershell
#   932160: /bin/sh
#   932250: ls -la
#   932260: python3
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
    "id:900680,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:q,\
    ctl:ruleRemoveTargetById=932120;ARGS:q,\
    ctl:ruleRemoveTargetById=932160;ARGS:q,\
    ctl:ruleRemoveTargetById=932250;ARGS:q,\
    ctl:ruleRemoveTargetById=932260;ARGS:q"

# Forgejo renames a branch on its own path, where from and to name branches.
# They skip the list of command names (932260), which refused
# feat/docker-support and feat/python3-support. They are read only while
# SWW_WAF_BODY_LIMIT is set, and skip nothing when the query has a parameter of
# the same name.
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/settings/rename_branch$" \
    "id:900666,phase:1,pass,nolog,chain"
    SecRule &ARGS_GET:/^(?:from|to)$/ "@eq 0" \
        "ctl:ruleRemoveTargetById=932260;ARGS:from,\
        ctl:ruleRemoveTargetById=932260;ARGS:to"