From 16a8d8c8f2b1ad7aec0908fccb5b0c79f98743f3 Mon Sep 17 00:00:00 2001
From: Julien (jvoisin) Voisin
Date: Thu, 16 Jun 2016 13:15:51 +0200
Subject: Cloudflare rule is _public_, no need to put it in another rule

---
 php-malware-finder/php.yar | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 7ace9f0..dad427b 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -90,7 +90,7 @@ rule DodgyPhp
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
 
     condition:
-        (any of them or CloudFlareBypass) and not IsWhitelisted
+        any of them and not IsWhitelisted
 }
 
 rule DangerousPhp
@@ -132,6 +132,7 @@ rule DangerousPhp
         $ = "posix_setuid" fullword nocase
         $ = "preg_replace_callback" fullword
         $ = "proc_open" fullword nocase
+        $ = "proc_close" fullword nocase
         $ = "popen" fullword nocase
         $ = "register_shutdown_function" fullword nocase
         $ = "register_tick_function" fullword nocase
-- 
cgit v1.3