So sorry. I didn't give you the right code. Try this. should work better.
when HTTP_REQUEST {
if { [string tolower [HTTP::uri]] contains "/Whatever/You/Are/Looking/For" } {
Remove the Accept-Encoding header so that the server will not compress the response
(otherwise the stream rewriter won't work, since it doesn't decompress the stream)
HTTP::header remove "Accept-Encoding"
Set a variable so we know to do custom stream rewrite
set strReplace 1
Disable the default stream profile so we can modify it on response
STREAM::disable
}
}
when HTTP_RESPONSE {
if { [info exists strReplace] && $strReplace && [HTTP::header "Content-Type"] contains "html" } {
Look for any form tags
set expr {@]*>@@}
STREAM::expression $expr
Enable the stream profile
STREAM::enable
}
}
when STREAM_MATCHED {
Log the match that was found
log local0. " Match: '[STREAM::match]'"
Manual replacement to add the action attribute (since we couldn't check in expression)
if { not ([STREAM::match] contains "action=") } {
STREAM::replace [string map {"