From b5cc1a99db064da8f019d02a0ada1cdd94620779 Mon Sep 17 00:00:00 2001
From: Miroslav Stampar <miroslav.stampar@gmail.com>
Date: Thu, 28 Feb 2013 18:54:12 +0100
Subject: [PATCH] Minor fix (KONA uses same core set rules)

---
 waf/modsecurity.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/waf/modsecurity.py b/waf/modsecurity.py
index 2bdbcd122..dfecb1ff0 100644
--- a/waf/modsecurity.py
+++ b/waf/modsecurity.py
@@ -17,7 +17,7 @@ def detect(get_page):
 
     for vector in WAF_ATTACK_VECTORS:
         page, headers, code = get_page(get=vector)
-        retval = code == 501
+        retval = code == 501 and re.search(r"Reference #[0-9A-Fa-f.]+", page, re.I) is None
         retval |= re.search(r"Mod_Security|NOYB", headers.get(HTTPHEADER.SERVER, ""), re.I) is not None
         if retval:
             break