From f7879f81e8ec3825d7e23cb370018cb568346c50 Mon Sep 17 00:00:00 2001
From: Eileen Donlon <emdonlo@gmail.com>
Date: Mon, 30 Apr 2012 11:52:20 -0400
Subject: [PATCH] disallow file_data with flow:to_server/from_client

---
 src/detect-file-data.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index f4e2842a7a..d302c8bfcf 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -72,7 +72,10 @@ void DetectFiledataRegister(void) {
 static int DetectFiledataSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
 {
     SCEnter();
-
+    if (s->init_flags & SIG_FLAG_INIT_FLOW && s->flags & SIG_FLAG_TOSERVER && !(s->flags & SIG_FLAG_TOCLIENT)) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use file_data with flow:to_server or from_client with http.");
+        return -1;
+    }
     s->init_flags |= SIG_FLAG_INIT_FILE_DATA;
 
     return 0;
-- 
2.47.2