From 97e40815938fbedd6a0d3018d7a0405ee1a161d7 Mon Sep 17 00:00:00 2001 From: Ermal Date: Wed, 18 Jul 2012 21:48:15 +0000 Subject: Tune the regex --- config/snort/snort_check_for_rule_updates.php | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/config/snort/snort_check_for_rule_updates.php b/config/snort/snort_check_for_rule_updates.php index f6299faa..6c6440e9 100644 --- a/config/snort/snort_check_for_rule_updates.php +++ b/config/snort/snort_check_for_rule_updates.php @@ -158,12 +158,10 @@ if ($emergingthreats == "on") { /* Normalize rulesets */ $sedcmd = "s/^#alert/# alert/g\n"; $sedcmd .= "s/^##alert/# alert/g\n"; -$sedcmd .= "s/^# alert/# alert/g\n"; -$sedcmd .= "s/^#\\talert/# alert/g\n"; -$sedcmd .= "s/^##i\talert/# alert/g\n"; +$sedcmd .= "s/^#[ \\t#]*alert/# alert/g\n"; +$sedcmd .= "s/^##\\talert/# alert/g\n"; $sedcmd .= "s/^\\talert/alert/g\n"; -$sedcmd .= "s/^ alert/alert/g\n"; -$sedcmd .= "s/^ alert/alert/g\n"; +$sedcmd .= "s/^[ \\t]*alert/alert/g\n"; @file_put_contents("{$snortdir}/tmp/sedcmd", $sedcmd); /* Untar snort rules file individually to help people with low system specs */ -- cgit v1.2.3