summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2018-08-31Bump the changelogv0.4.0jvoisin
2018-08-30Minor code cleanupxXx-caillou-xXx
2018-08-30Change how we're handling invalid configurationsxXx-caillou-xXx
Since our configuration format is a bit more complex than php's one, we have a `sp.allow_broken_configuration` parameter (`false` by default), that you can set to `true` if you want PHP to carry on if your Snuffleupagus' configuration contains syntax errors. You'll still get a big scary message in your logs of course. We do **not** recommend to use it of course, but sometimes it might be useful to be able to "debug in production" without breaking your website.
2018-08-30Match on ret improvementsxXx-caillou-xXx
This commit does two things: - Implement matching on calltraces for ret - Implement matching on ret of user functions if the return value is not used.
2018-08-30Fix two typos in the readmeMathieu Deous
2018-08-29Change how we're validating certificatesxXx-caillou-xXx
2018-08-29Add new propaganda items, include ourselves and swisscenterThibault "bui" Koechlin
2018-08-29Remove the GLOB_BRACE flagAntoine Tenart
When calling glob() to get the configuration file location, the GLOB_BRACE flag is used. This flag enables the parsing of '{a,b}', so that '/path/{a,b}' represents '/path/a' and '/path/b'. Looking at Snuffleupagus' documentation I saw nowhere this kind of path was supported. Instead the documentation shows that glob() is used for paths with wildcards. The use of GLOB_BRACE is problematic as it is glibc specific and is not supported by some other C libraries, such as Musl. Snuffleupagus cannot be used in Apline for this reason. Since the documentation does not give a valid usage of GLOB_BRACE this patch removes it, which fixes the non-glibc support. Signed-off-by: Antoine Tenart <antoine.tenart@ack.tf>
2018-08-29Verify certs (#223)jvoisin
Ensure that certificates are verified in curl should close #47
2018-08-28Fix some compilation warningsxXx-caillou-xXx
2018-08-28Fix a SIGSEGV on user-created function's return valuexXx-caillou-xXx
2018-08-28Add array_search and array_keys hooks to kill sloppy comparisonsxXx-caillou-xXx
2018-08-28Add a test for invalid regexp in cookie-related featuresxXx-caillou-xXx
This should close #105
2018-08-28Use php's logging functionsxXx-caillou-xXx
This commit replace our usage of `php_log_err` with `zend_error`. This should allow administrators to display errors in the webpage, should they want to; and to properly manipulate the verbosity's level. This should close #217
2018-08-28Document some features in our READMEjvoisin
2018-08-28Add a test for sloppy-comparisons in arraysjvoisin
2018-08-27Enable strict mode for `in_array` with sloppy_comparisonxXx-caillou-xXx
2018-08-27Document that the previous commit might break other cookie-related extensionsjvoisin
2018-08-27Use php_setcookie function (PHP public API)Remi Collet
This commit vastly simplifies the code of cookies-fiddling mechanisms.
2018-08-27Add whitelist support for php's wrappersxXx-caillou-xXx
2018-08-27Modify test for callback functionsxXx-caillou-xXx
close #171
2018-08-27Fix the `make install`jvoisin
2018-08-23Fix a typo in a linkjvoisin
2018-08-23Add some articles to the propaganda pagejvoisin
2018-08-21Fix a linkjvoisin
2018-08-21Document our type-juggling-prevention systemjvoisin
2018-08-20Add test for params matchingxXx-caillou-xXx
2018-08-20Bump the changlogv0.3.1hamza (hes) ES SAHELY
2018-08-20Fix two minor issuesxXx-caillou-xXx
- Fix an infinite loop on `echo` hook - Use the correct function to compare filenames internally
2018-08-17Add ignore hash feature in `generate_rules.php` (#208)xXx-caillou-xXx
https://github.com/nbs-system/snuffleupagus/issues/206
2018-08-09Fix yet an other hang/crashjvoisin
There are valid reasons for `orig_zend_execute_internal` to be `NULL`, we we're not checking if it is, well, `NULL`.
2018-08-09Fix a typo in the previous commitsjvoisin
2018-08-09Yet an other crash/hang fixjvoisin
Like the two previous commits
2018-08-09Fix a possible crash/hang in floppy-comparisonjvoisin
This is in the same spirit than the previous commit
2018-08-09Fix a crash/hang when using fpm's poolsjvoisin
We might have ended up in infinite loops when using php-fpm, if several different process hooked some functions twice. Thanks to @sriccio for reporting the issue
2018-08-09Improve the cookie encryption documentationkka
2018-08-02fix #203 (#204)crKontrol
sp.disable_function.function().filename doesn't take phar:///
2018-07-24Fix a configuration issue in the PKGBUILDjvoisin
thanks to @troudbal
2018-07-24Remove two useless filesjvoisin
2018-07-23Improve a bit the default rulesjvoisin
- Use plain values instead of regexp where possible - Reduce the number of false positives (*cough* `curl_exec` *cough*)
2018-07-23Whitelist the inclusion of `.phtml` filesjvoisin
This is the extension used by PhpMyAdmin
2018-07-23Allow the inclusion of `.inc` filesjvoisin
2018-07-23Use SameSite on PHP's session cookie in the default rulesjvoisin
2018-07-23Activate more features in the default rulesjvoisin
2018-07-19Add some slidesjvoisin
2018-07-19Fix the issue with rand hardeningxXx-caillou-xXx
2018-07-19Fix the changelog's linksjvoisin
2018-07-19Document that you need to `git push` after the release :pjvoisin
2018-07-19Bump the changelogkka
2018-07-18Improve a bit our release processjvoisin