grabbing content-disposition headers only in certain cases.

gistfile1.txt

@load base/protocols/http

const watchlist_url_patterns = /^.*/test.php\// &redef;

redef record Conn::Info += {
        content_disposition: string &optional &log;
};

event http_all_headers(c: connection, is_orig: bool, hlist: mime_header_list)
        {
        if ( ! is_orig || c$http$method != "POST" )
                return;

        local url = HTTP::build_url(c$http);
        if ( HTTP::watchlist_url_patterns in url )
                {
                for ( i in hlist )
                        {
                        local hdr = hlist[i]i$name;
                        local value = hlist[i]$value;
                        if ( hdr == "CONTENT-DISPOSITION" )
                                c$http$content_disposition = value;
                        }
                }
        }