samwaf
f383bd16e6
feat:save visit log column config per account on server
...
#893
2026-07-28 10:36:38 +08:00
samwaf
155a038433
feat:add nickname in weblog list
...
#IK0NJJ
2026-07-27 14:48:54 +08:00
samwaf
e35d318bcb
fix:list rule moved to another site left stale cache on the old site
...
#898
2026-07-27 11:43:25 +08:00
samwaf
08609e819f
fix:site overview GROUP BY breaks on MySQL/PostgreSQL
2026-07-27 10:27:14 +08:00
samwaf
7eedb74c3b
feat:batch import hosts from nginx
...
#881
2026-07-16 10:26:52 +08:00
samwaf
8f3ad4d9c8
fix:docker iptable bug
...
#IK0319
2026-07-14 16:02:19 +08:00
samwaf
d5fc1901e8
feat:postgres
...
#855
2026-07-14 11:33:06 +08:00
samwaf
e52bdc180c
fix:first db bug
2026-07-14 09:14:57 +08:00
samwaf
c7cdbe397a
feat:add AI rule generation, GPT settings, request timeout config and rule chain mode entry
...
#844
2026-07-13 16:43:23 +08:00
samwaf
0b87b371a0
fix(security): gate /debug behind auth+ip-whitelist, CORS origin allowlist with loopback bypass (N8, N9)
2026-07-06 11:41:07 +08:00
samwaf
98035772ca
fix(security): SSRF +OTP rate limit+IP binding+account authorization
2026-07-06 08:48:14 +08:00
samwaf
8aae66efbe
fix(security): validate trusted proxy before honoring client-IP headers on management port
...
- default GCONFIG_MANAGE_PROXY_HEADER to empty; add GCONFIG_MANAGE_TRUSTED_PROXIES
2026-07-03 22:35:59 +08:00
samwaf
8e4286150d
fix(security): structured whitelist for SQL query API (remove raw SQL)
...
- Replace raw SQL execution with a structured query (table/mode/columns/filters/top); backend no longer accepts any SQL string
- Fail-closed table & column whitelist: block sensitive tables (auth/key/cert/config/plugin) and columns (password/secret/token/private/key)
- Block EAV/key-value tables (value/params columns) to prevent plaintext secret leak, e.g. system_configs.value
- Parameterize all filter values via GORM clause expressions; operator whitelist; cap filters/IN length
- Add queryable-schema endpoint + query audit logging; harden GetTableInfo to skip sensitive tables/columns
2026-07-03 16:30:53 +08:00
samwaf
c8dc8853c4
fix(security): bcrypt password hashing + server-side forced password change
...
- Migrate MD5+global-salt hashing to bcrypt with transparent upgrade on login
- Enforce password change in Auth middleware (allow only changepwd/logout/ws)
- Generate random initial admin password on fresh install (data/initial_password.txt)
2026-07-03 14:47:59 +08:00
samwaf
4f8ed193ce
fix:mysql field
...
#854
2026-07-02 13:59:35 +08:00
samwaf
74dfab253a
feat:tamper url extract, batch ops, table filter/sort
...
#844
2026-07-01 16:43:15 +08:00
samwaf
d698f88e69
feat:web page anti-tamper protection
2026-07-01 13:47:32 +08:00
samwaf
512492e163
feat:manage ssl auto load
...
#815 #842 #843
2026-06-29 17:08:53 +08:00
samwaf
10174920d6
feat:add account rbac
...
#844
2026-06-29 14:05:09 +08:00
samwaf
a4aa6d8b9c
fix:ipdb save bug
...
#840
2026-06-29 09:03:16 +08:00
samwaf
39dffafab6
fix: fix the issue of MySql table partitioning not take effect
...
#IJULAW
2026-06-16 11:16:32 +08:00
samwaf
17ac5ebbd3
feat:add light ai model
...
#827
2026-06-15 17:00:35 +08:00
samwaf
4ea423b229
feat:strengthen the safety operation of the application management
...
#823
2026-06-09 17:31:53 +08:00
samwaf
7a53b6779d
fix:when deleting the application,it should be disabled
...
#823
2026-06-09 09:23:30 +08:00
samwaf
4028e9a428
feat:add application management
...
#823
2026-06-08 16:08:54 +08:00
samwaf
31780eb115
feat: add host nickname
...
#IJR74L
2026-06-08 09:54:42 +08:00
samwaf
d571e197fd
feat:support ipdb
...
#809
2026-06-03 13:29:34 +08:00
samwaf
7473206f24
feat:add domain whitelist
...
#IJQNEX
2026-05-29 15:07:04 +08:00
samwaf
261d2f3865
fix:weblog slow
...
#782
2026-05-26 11:39:45 +08:00
samwaf
b4d527e042
feat:add path rule
...
#579
2026-05-14 14:08:42 +08:00
samwaf
a1b22cd437
feat:add version rollback
...
#250 #801
2026-05-11 16:58:52 +08:00
samwaf
2f6b0d39c2
feat:manage proxy header
...
#781
2026-05-06 15:09:55 +08:00
samwaf
2001582580
feat:owaspset api
...
#546
2026-04-24 16:52:53 +08:00
samwaf
b1cd8daec6
fix:owaspset reset
...
#546
2026-04-24 15:05:10 +08:00
samwaf
f457f31eee
feat: owaspruleset
...
#546
2026-04-22 15:55:58 +08:00
samwaf
25c5bbedfe
feat: owasp
...
#546
2026-04-20 17:32:11 +08:00
samwaf
fd05e7b3ca
feat: add skip global cc
...
#745
2026-04-17 10:14:30 +08:00
samwaf
2a1ddbf591
fix:manage ip empty bug
...
#752
2026-04-16 14:06:36 +08:00
samwaf
a9b46c3c91
fix:stat bug
...
#752
2026-04-16 14:05:33 +08:00
samwaf
af5334067d
fix:sensitive empty
...
#752
2026-04-16 14:05:05 +08:00
samwaf
9fc4f18655
feat:add notice pre
...
#727
2026-04-15 15:07:23 +08:00
samwaf
ea2d5decb9
fix:openapi url
...
#752
2026-04-14 09:35:56 +08:00
samwaf
4a3c0302b6
feat:add task log
...
#750
2026-04-13 14:29:17 +08:00
samwaf
bc43046321
feat: data cleaning strategy
...
#729
2026-04-11 08:17:28 +08:00
samwaf
693c0eed6e
feat: add safe entry
...
#IHWKI6
2026-04-07 15:15:49 +08:00
samwaf
cbf5428d3d
feat: add database table information
...
#740
2026-04-07 11:03:37 +08:00
lvshujun
e910584cca
feat: skip dns local check
2026-03-25 15:10:54 +08:00
samwaf
ddbd591203
fix:api doc
2026-03-24 15:01:58 +08:00
samwaf
07656678e3
feat:add overview
...
#673
2026-03-10 16:54:05 +08:00
samwaf
dbe5a151bf
feat:add open platform more api
...
#664 #698
2026-03-09 15:55:15 +08:00
samwaf