sagan
sagan copied to clipboard
With Bluedot disabled, you can still load bluedot rules
Just an idea:
rules.c - line 2760
Possible fix:
change if (!strcmp(rulesplit, "bluedot")) to if (!strcmp(rulesplit, "bluedot") && config->bluedot_flag == 1)
Looks like rules.c checks to see if the "WITH_BLUEDOT" is set and then checks for "bluedot" in the rule name and then loads the rule. Changing the if statement to check if the "bluedot_flag" is set first should allow it to skip loading the rule if bluedot is compiled and bluedot is not enabled but rules are enabled.
To be honest... there was no testing of code involved, just reviewing.