summaryrefslogtreecommitdiff
path: root/config (unfollow)
AgeCommit message (Collapse)Author
2026-01-21Update default.rulessantii-git
Set the correct PHP versions for each rule and add the mb_send_mail function.
2025-09-30Make the default rules compatible via PHP8santii-git
2025-09-30Make the default rules compatible via PHP8jvoisin
As suggested by @santii-git in https://github.com/jvoisin/snuffleupagus/issues/522
2025-05-25Unify/fix the default.rules file across PHP versions, and add some new onesjvoisin
2024-06-09Forbid file:// protocol in Curlbohwaz
2024-06-09Wording updatesChristian Göttsche
2024-06-09Add option to specify the allowed "php" wrapper typesChristian Göttsche
In addition of the current possibility to filter wrappers by their protocol name, also add the option to filter the "php" wrapper by the requested kind. Especially the 'filter' backend can be disabled that way.
2024-06-06Fix misc typosChristian Göttsche
2024-03-24Fix yet another php surprised-rename of functions parametersjvoisin
2023-11-27Update config/ini_protection.rulesJulien Voisin
2023-11-27Add condition for mysqli.reconnectChristian Göttsche
mysqli.reconnect has been removed in PHP 8.2, see https://www.php.net/manual/de/mysqli.configuration.php#ini.mysqli.reconnect.
2023-11-03Add some documentation in the default rules.jvoisin
2023-02-16Add another burned vuln to the php8 rulesJulien Voisin
2023-02-16Add another burned vuln to the php7 rulesJulien Voisin
2023-01-03Add example configuration for Xenforo 2.2.12Tristan
2022-08-18Fix the default configuration on php7.4+jvoisin
2022-04-17Improve the portability of the php7 rulesjvoisin
2022-01-11make xxe protection conditional in default rulesBen Fuhrmannek
2022-01-11enable strict_mode in example configBen Fuhrmannek
2022-01-10renamed ini protection example rulesBen Fuhrmannek
2022-01-10added conditions to ini protection exampleBen Fuhrmannek
2022-01-07added dangerous extension checkBen Fuhrmannek
2021-11-26PHP8 update parameters name in "move_uploaded_file" (#406)pfdutot
In the 8.0.8 and 8.1 version of PHP, the parameters name for move_uploaded_file are "from" and "to". This config file fail to apply the relevant rules unless the parameter names are updated using "to" instead of "destination".
2021-11-11inverted logic. set xxe_protection.enable() instead of disable_xxe.disable()Ben Fuhrmannek
2021-08-30fixed typoBen Fuhrmannek
2021-08-29updated documentation URLBen Fuhrmannek
2021-08-18ported Suhosin rules to Snuffleupagus rulesBen Fuhrmannek
2021-08-18updated documentation URLBen Fuhrmannek
2021-08-16Fix a few typos and inconsistencies in config filesGasper Vozel
2021-08-07more ini protection featuresBen Fuhrmannek
2021-08-06default ruleset for ini protection featureBen Fuhrmannek
2021-05-09Fix disable function chmodWhiteWinterWolf
2021-05-01Additional PHP 8 sample config argument name changesTristan Deloche
2021-05-01Improve our SQLI-related documentation and remove some useless rulesjvoisin
2021-04-27Update some parameter names which changed for PHP 8.0Tristan Deloche
2021-04-26Add a configuration file for php8jvoisin
2020-06-07Lockdown of the logging directivesjvoisin
This is done to prevent an attacker who obtained arbitrary code execution to mess with the logging configuration.
2020-04-25Fix and improve the previous commitjvoisin
2020-04-25Add yet an other stupid things to the default set of rulesjvoisin
2020-04-24Add yet another disabled_functions bypassjvoisin
2019-10-16Fix the default configurationjvoisin
ini_[sg]et first parameter is actually varname, and not var_name. Thanks to @gergo314 for flagging this!
2019-04-07Protect against a now-public open_basedir bypassjvoisin
2019-01-16Improve a bit the default rulesjvoisin
2018-12-25Tighten a bit the command-injection prevention rulejvoisin
2018-08-29Change how we're validating certificatesxXx-caillou-xXx
2018-08-29Verify certs (#223)jvoisin
Ensure that certificates are verified in curl should close #47
2018-07-23Improve a bit the default rulesjvoisin
- Use plain values instead of regexp where possible - Reduce the number of false positives (*cough* `curl_exec` *cough*)
2018-07-23Whitelist the inclusion of `.phtml` filesjvoisin
This is the extension used by PhpMyAdmin
2018-07-23Allow the inclusion of `.inc` filesjvoisin
2018-07-23Use SameSite on PHP's session cookie in the default rulesjvoisin