# Forgejo's fixes: on Forgejo's paths, some fields skip the rules that refused
# ordinary Forgejo requests there. Forgejo is a fork of gitea. A hostname that
# gets Forgejo's fixes gets gitea's too, so this file holds only what Forgejo
# sends and gitea does not. Each exclusion runs with the request, before the
# rules it switches off, so this file is loaded before the Core Rule Set's
# rules. Each comment names a request the rule refused.

# Unless SWW_APPS lists forgejo for the request's hostname, every rule below is
# skipped. Inspect sets tx.app_forgejo when it does.
# The skip reaches only phase 1, so a rule of a later phase must check
# tx.app_forgejo itself.
SecRule &TX:app_forgejo "@eq 0" \
    "id:900670,phase:1,pass,nolog,skipAfter:END_FORGEJO"

# Forgejo's search of a wiki sends the text searched for in q, which skips
# these rules there:
#   930120: .htaccess
#   932120: powershell
#   932160: /bin/sh
#   932250: ls -la
#   932260: python3
SecRule REQUEST_FILENAME "@rx ^/[^/]+/[^/]+/wiki/search$" \
    "id:900680,phase:1,pass,nolog,\
    ctl:ruleRemoveTargetById=930120;ARGS:q,\
    ctl:ruleRemoveTargetById=932120;ARGS:q,\
    ctl:ruleRemoveTargetById=932160;ARGS:q,\
    ctl:ruleRemoveTargetById=932250;ARGS:q,\
    ctl:ruleRemoveTargetById=932260;ARGS:q"

# Forgejo's admin page searches the names of repositories in q on /admin/repos,
# which skips the list of command names (932260) there. It refused python3.
SecRule REQUEST_FILENAME "@streq /admin/repos" \
    "id:900681,phase:1,pass,nolog,ctl:ruleRemoveTargetById=932260;ARGS:q"

SecMarker END_FORGEJO