samwaf
78fbd55e7a
fix: distinguish a cache miss from an unavailable cache backend
...
#938
2026-09-12 21:46:37 +08:00
samwafgo
49f29fbd77
Merge pull request #997 from samwafgo/fix_access_cros
...
fix:access cors
2026-09-07 16:20:26 +08:00
samwaf
baade92bee
fix:access cors
2026-09-07 16:18:29 +08:00
samwafgo
30d550f310
Merge pull request #996 from samwafgo/fix_manage_clientip
...
fix: resolve the management client IP when trusted proxy ranges cover…
2026-09-06 15:35:46 +08:00
samwaf
a222c70036
fix: resolve the management client IP when trusted proxy ranges cover the client itself
...
#994
2026-09-06 15:30:37 +08:00
samwafgo
e1572c61cd
Merge pull request #995 from samwafgo/feat_visit_password
...
feat:website password session lifetime and online session management
2026-09-06 07:36:03 +08:00
samwaf
c3b263b7f3
feat:website password session lifetime and online session management
...
#987
2026-09-06 07:32:04 +08:00
samwafgo
c379f41729
Merge pull request #993 from samwafgo/fix_sslorder_empty
...
fix:ssl folder empty
2026-09-04 15:56:20 +08:00
samwaf
7a1832257e
fix:ssl folder empty
...
#991
2026-09-04 15:55:23 +08:00
samwafgo
271dac042d
Merge pull request #992 from samwafgo/fix_outbound_url
...
fix: honor security.outbound_allowed_hosts for notification channel w…
2026-09-04 14:00:13 +08:00
samwaf
dbe30c74cf
fix: honor security.outbound_allowed_hosts for notification channel webhooks
...
#990
2026-09-04 13:49:04 +08:00
samwaf
0c2cb122e4
!40 feat: enhance cc
...
Merge pull request !40 from samwaf/feat_enharnce_cc
2026-09-03 03:23:52 +00:00
samwaf
619155764f
feat: enhance cc
...
#IK7J58
2026-09-03 11:22:53 +08:00
samwafgo
85a6186bfe
Merge pull request #985 from samwafgo/fix_ssl_bug
...
fix:bind host to the ssl config id actually persisted
2026-08-31 16:18:11 +08:00
samwaf
4ad4840c4e
fix:bind host to the ssl config id actually persisted
2026-08-31 16:02:30 +08:00
samwafgo
e6f8d875cf
Merge pull request #983 from samwafgo/feat_update_process
...
feat:add update process
2026-08-31 11:41:14 +08:00
samwaf
d611961172
feat:add update process
2026-08-31 11:32:14 +08:00
samwafgo
7b772542a8
Merge pull request #982 from samwafgo/feat_port_protocol
...
Feat port protocol
2026-08-30 14:40:20 +08:00
samwaf
b3a998a815
feat:add port protocol
...
#955
2026-08-30 14:39:12 +08:00
samwaf
72a3ebc726
feat:add host group doc
...
#980
2026-08-28 20:34:21 +08:00
samwafgo
fe0d72eb30
Merge pull request #981 from samwafgo/feat_host_group
...
feat:add host group
2026-08-28 17:19:16 +08:00
samwaf
2f18485946
feat:add host group
...
#980
2026-08-28 17:15:24 +08:00
samwaf
8caf41247d
update:(20260827) v1.3.24 fix bug
2026-08-27 14:44:38 +08:00
samwafgo
c2ead73f9b
Merge pull request #979 from samwafgo/feat_run_diagnostic
...
feat: add run diagnostic for troubleshooting CPU/memory usage & del d…
2026-08-27 11:37:02 +08:00
samwaf
4228b5a5f4
feat: add run diagnostic for troubleshooting CPU/memory usage & del developer tools out of the main repo
2026-08-27 11:32:07 +08:00
samwaf
f05ffd0a24
ci: speed up the release pipeline and align the Go toolchain
2026-08-26 17:33:50 +08:00
samwaf
4f58345359
feat:modify tips
2026-08-26 17:06:00 +08:00
samwafgo
ac495c03a6
Merge pull request #978 from samwafgo/feat_local_manager
...
feat:merge manager access with certificate config
2026-08-26 12:55:04 +08:00
samwaf
459c193124
feat:merge manager access with certificate config
2026-08-26 12:52:10 +08:00
samwafgo
caca3e251b
Merge pull request #977 from samwafgo/feat_manage_cert
...
feat: add local CA certificate management for the console
2026-08-26 09:31:07 +08:00
samwaf
984e45804b
feat: add local CA certificate management for the console
2026-08-26 09:28:26 +08:00
samwafgo
1c5ba101d9
Merge pull request #976 from samwafgo/feat_transport_v2
...
feat: negotiate a per-session key for console traffic
2026-08-25 19:53:04 +08:00
samwaf
d44f956ff5
feat: negotiate a per-session key for console traffic
2026-08-25 19:50:33 +08:00
samwafgo
ff14c68404
Merge pull request #975 from samwafgo/feat_data_key
...
feat: encrypt stored credentials with a per-instance data key and mas…
2026-08-25 12:31:59 +08:00
samwaf
31a4937636
feat: encrypt stored credentials with a per-instance data key and mask secret fields
2026-08-25 11:39:36 +08:00
samwafgo
67623441c1
Merge pull request #974 from samwafgo/fix_remove_center
...
fix: remove the central-management feature
2026-08-24 13:42:51 +08:00
samwaf
50127ad8ea
fix: remove the central-management feature
2026-08-24 13:39:05 +08:00
samwafgo
48ac3597b0
Merge pull request #971 from samwafgo/fix_batch_task
...
fix: validate batch task data source before reading
2026-08-24 09:06:39 +08:00
samwaf
77ffa81ef0
fix: validate batch task data source before reading
2026-08-24 09:05:42 +08:00
samwafgo
02604d7de7
Merge pull request #970 from samwafgo/feat_impoved_check
...
feat: strengthen WAF detection coverage and gate the new inspection p…
2026-08-23 11:30:33 +08:00
samwaf
24227923e8
feat: strengthen WAF detection coverage and gate the new inspection paths
...
Detection engine:
- Normalize request data (body, cookies, form and JSON values, request headers)
before inspection instead of only the URL query string, so encoded variants
are evaluated consistently.
- Extend XSS / SQLi / command-injection inspection to request bodies and to
custom request headers; bodies and headers are scanned per value rather than
as one blob to keep false positives low.
- Add a configurable body inspection mode (body_detect_mode: observe/block/off,
default observe) so the new deep checks record rather than block until an
operator confirms them, plus body_detect_field_exclude to skip fields that
legitimately carry rich text.
- Keep false positives down on the new paths: skip structured values, require a
corroborating signal before flagging body/header XSS, and leave dual-use
keywords out of the fallback lists.
- Path traversal is now normalized and judged on whether it escapes the site
root instead of matching literally; this also clears a long-standing false
positive on legitimate in-site relative paths. Adds a sensitive-file list.
- Scanner detection now covers all request headers and known probe paths.
Plugins:
- Suspend plugin loading pending signing and admission work. The code path is
retained but gated off, and shipped disabled by default.
Validated against a local test corpus and a 33k real-traffic benchmark:
detection improved across every category while the real-traffic false-positive
count stayed flat.
2026-08-23 11:29:22 +08:00
samwafgo
8c9e2c12c4
Merge pull request #967 from samwafgo/feat_update_tips
...
feat: show the release version in upgrade notes
2026-08-22 18:38:11 +08:00
samwaf
89ae2bad67
feat: show the release version in upgrade notes
2026-08-22 18:31:41 +08:00
samwafgo
88eef34d65
Merge pull request #966 from samwafgo/fix_upload
...
fix: check every backend-resolvable multipart filename to prevent upl…
2026-08-21 23:36:32 +08:00
samwaf
f180074bba
fix: check every backend-resolvable multipart filename to prevent upload extension
2026-08-21 23:32:19 +08:00
samwafgo
71111d7865
fix:ssl export ( #965 )
2026-08-21 22:03:42 +08:00
samwaf
b3379d4150
fix:ssl export
2026-08-21 21:53:50 +08:00
samwaf
dfc4427cdd
fix: same-period comparison and live QPS trend on the dashboard cards
...
#964
2026-08-21 08:45:31 +08:00
samwafgo
40a2450ae6
Feat ip tag ( #963 )
...
* feat:group risk log rule tags into a searchable sidebar
2026-08-20 17:12:19 +08:00
samwafgo
6d0a506b83
feat: scanner detection — inspect User-Agent, case-insensitive, expand fingerprints ( #962 )
2026-08-20 13:30:02 +08:00
samwaf