| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2018-12-21 | bump the changelogv0.4.1 | kka | |
| 2018-12-15 | Document the previous commit | jvoisin | |
| 2018-12-15 | Provide a php script, to get rid of the python one for test suite | Remi Collet | |
| This commit adds a php version of the upload_validation.py script. | |||
| 2018-12-15 | Improve simulation mode for session cookies (#259) | jvoisin | |
| Since decrypt_zval doesn't provide a way to tell apart failed and successful decryption when used in simulation mode, we'll have to restore the original value if something goes wrong, because crypto_secretbox_open might modify the value. | |||
| 2018-12-07 | Add support for php7.3 | jvoisin | |
| 2018-12-01 | Improve the documentation wrt. functions hooked by sloppy comparisons | jvoisin | |
| This should close #264 | |||
| 2018-11-29 | Document our curl-tls-verification magic | jvoisin | |
| 2018-11-23 | Document a bit more the threat model | jvoisin | |
| 2018-11-18 | Minor code clarification | jvoisin | |
| 2018-11-18 | Improve the cookie encryption documentation | jvoisin | |
| This should close #261 | |||
| 2018-11-18 | Add alertot to the list of users | jvoisin | |
| Source: https://twitter.com/alertot/status/1063366265593622528 | |||
| 2018-10-25 | Minor formatting issue | jvoisin | |
| 2018-10-25 | Snuffleupagus should now compile on Windows | jvoisin | |
| 2018-10-23 | Improve a bit the documentation, again | jvoisin | |
| 2018-10-23 | Clarify a bit the documentation | jvoisin | |
| A user was a bit afraid that Snuffleupagus might damage their website permanently, so we rephrase the documentation to convey that this is not the case. | |||
| 2018-10-09 | Bump again | jvoisin | |
| 2018-10-09 | Bump coverage | jvoisin | |
| 2018-10-09 | Bump the coverage a bit | jvoisin | |
| 2018-10-09 | Remove 3 useless lines | jvoisin | |
| 2018-10-09 | Don't check the return values of functions that might not return (#255) | jvoisin | |
| This is due to our modifications to the logging system | |||
| 2018-10-09 | Improve mb_string hooking logic | jvoisin | |
| 2018-10-08 | Add a test | jvoisin | |
| 2018-10-07 | Document the `.pos` filter | jvoisin | |
| 2018-10-06 | Add a missing opcode in sp_execute_ex | jvoisin | |
| 2018-10-06 | Coverage++ | jvoisin | |
| 2018-10-06 | Bump coverage again | jvoisin | |
| 2018-10-06 | Bump coverage again | jvoisin | |
| 2018-10-06 | Fix the silly mistake for good | jvoisin | |
| 2018-10-06 | Improve a bit the documentation | jvoisin | |
| Thanks to @joe for bringing up this issue ♥ | |||
| 2018-10-06 | Fix a silly mistake | jvoisin | |
| 2018-10-06 | Add a test | jvoisin | |
| 2018-10-06 | Bump a bit the coverage | jvoisin | |
| * `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable | |||
| 2018-10-06 | Remove sp_terminate and bump a bit the coverage | jvoisin | |
| 2018-10-05 | Fix segfault array keys | kkadosh | |
| Many thanks to @xXx-caillou-xXx for finding the true root cause and fixing the issue ♥ | |||
| 2018-09-13 | Add a .mailmap file | jvoisin | |
| Check `git shortlog` with and without this file. | |||
| 2018-09-13 | Add the 44con's slides in the documentation | jvoisin | |
| 2018-09-13 | Add the 44con slides | jvoisin | |
| 2018-09-10 | Minor code simplification | jvoisin | |
| 2018-09-10 | Improve a bit the coverage | jvoisin | |
| 2018-09-10 | Bump the coverage | jvoisin | |
| 2018-09-10 | Try to improve a bit the display of the CI | jvoisin | |
| 2018-09-03 | Add a const attribute, added in 7.3 | Remi Collet | |
| 2018-09-03 | Fix #241 segfault on 32-bit related to bad protype (#242) | Remi Collet | |
| This should close #241 | |||
| 2018-09-01 | Add mentions to the propaganda page | jvoisin | |
| 2018-09-01 | Use php full path | Remi Collet | |
| Use the PHP_BINARY constant instead of "php". | |||
| 2018-08-31 | Bump the changelogv0.4.0 | jvoisin | |
| 2018-08-30 | Minor code cleanup | xXx-caillou-xXx | |
| 2018-08-30 | Change how we're handling invalid configurations | xXx-caillou-xXx | |
| Since our configuration format is a bit more complex than php's one, we have a `sp.allow_broken_configuration` parameter (`false` by default), that you can set to `true` if you want PHP to carry on if your Snuffleupagus' configuration contains syntax errors. You'll still get a big scary message in your logs of course. We do **not** recommend to use it of course, but sometimes it might be useful to be able to "debug in production" without breaking your website. | |||
| 2018-08-30 | Match on ret improvements | xXx-caillou-xXx | |
| This commit does two things: - Implement matching on calltraces for ret - Implement matching on ret of user functions if the return value is not used. | |||
| 2018-08-30 | Fix two typos in the readme | Mathieu Deous | |
 |
index : snuffleupagus | |
| Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! |
| summaryrefslogtreecommitdiff |