Release v2.7.6

• [NEW] See your shop's security score out of 100 at the top of the dashboard, with the state of each protection and a To do list of the actions that raise it
• [NEW] Follow a getting-started guide on the dashboard, each step ticking off by itself once done, including telling Sentinel whether your shop sits behind Cloudflare or a proxy
• [NEW] Find all of Sentinel's settings in the new Sentinel › Configuration menu, one tab per topic with a search field, including the brute-force, DDoS, trusted IPs, back office access and two-factor authentication settings
• [NEW] Deactivate employee accounts automatically after a chosen number of days without using the back office, always keeping the last active administrator
• [NEW] List the module pages and files that threat detection must never block, such as a payment confirmation
• Only employees allowed to configure Sentinel can now change the protection, back office access and two-factor authentication settings: give that permission to anyone who set them until now
• Threat detection no longer blocks your trusted IPs, and still shows in Security Logs what it recognised from them
• Fold or unfold the Core, Modules and Themes sections of the Integrity Check results and history, each one kept as you left it
• On the free plan, the direct PHP file access protection now only offers the Pro plan, no longer its installation

Documentation

Consulter la documentation complète

Release v2.7.5

• [NEW] The Integrity Check shows your themes in their own section next to Core and Modules: your PrestaShop theme is verified there, and your custom themes are listed as not verified
• [NEW] Submit a custom theme from the Integrity Check so that its files are verified at the next checks, with the Pro plan
• [NEW] Set the time of the automatic Security Scanner and Integrity Check, or pause them, from the module configuration page, with the Pro plan
• [NEW] Choose the e-mail addresses that receive the Security Scanner and Integrity Check reports from the module configuration page, with the Pro plan
• Show and filter brute force and rate limit bans in Security Logs, and show every event on the dashboard under the same translated name as in Security Logs
• Fix several ways for a file name, a visited page address or a message from the Sentinel service to run code in your back office from the dashboard, the Security Scanner or the Integrity Check
• Fix an employee with only the View permission on the Integrity Check being able to read the files holding the shop's secrets, database dumps or backups left at the root of the shop
• Fix an employee with only the View permission on the Module Manager being able to change Sentinel's settings on PrestaShop 9
• Fix a detected attack that could get through when its log entry could not be recorded
• Fix the brute-force protection never banning when the security log could not be written
• Fix threat detection turning off on Pro shops when the Sentinel service was unreachable
• Fix the auto_prepend protection not activating on Apache when the module is installed or updated from the command line
• Fix large requests being able to fill the shop's disk through the security log
• Fix an employee being refused a back-office page by chance, and the visit logged as an attack
• Fix the Integrity Check showing a section as intact when one of its folders or themes could not be checked
• Fix unbanned addresses that could stay refused or be banned again too quickly; unbanning from the DDoS Protection or Brute-force Protection screen now only lifts that screen's ban
• Fix the Auto Prepend tab of Security Logs missing some requests, failing to open on busy days, or showing the wrong entry details
• Stop copying the Redis password from the DDoS Protection screen into a file on the server; an existing copy is removed the next time the settings are saved
• Minor fixes

Documentation

Consulter la documentation complète

Release v2.7.4

• Fix turning threat detection on or off not applying to the auto_prepend protection right away
• Fix the auto_prepend protection still blocking threats after a subscription refresh on the free plan
• Fix the DDoS bans of the auto_prepend protection missing from the DDoS Protection screen and the dashboard, where they can now be lifted
• Fix the 404 events showing the proxy address instead of the visitor's behind a trusted proxy
• Fix the auto_prepend protection log showing the proxy address instead of the visitor's behind a trusted proxy
• Fix ban times shown hours apart from the attack that caused them when the database server runs in another time zone
• Fix the last attempt time in the attempted e-mails list being hours off when the database server runs in another time zone
• Fix Security Logs being deleted a few hours early or late when the database server runs in another time zone

Documentation

Consulter la documentation complète

Release v2.7.3

• Add module_key

Documentation

Consulter la documentation complète

Release v2.7.2

• Fix the QR code of the two-factor authentication enrollment not showing
• Fix a wrong back-office password on PrestaShop 9 answering with an HTTP 500 error instead of the login page: the failed attempt is logged again in Security Logs and counted by the brute-force protection
• Fix the two-factor authentication links to the "My methods" page on PrestaShop 9
• Fix sentinel:2fa:status failing to start on PrestaShop 9: its --profile option is renamed --profile-id, as PrestaShop 9 reserves --profile for its own console. This changes the command-line interface on every PrestaShop version: scripts calling sentinel:2fa:status --profile=<id> must switch to --profile-id=<id>

Documentation

Consulter la documentation complète

Release v2.7.1

• Fix the vulnerability scan failing with an HTTP 422 error when a third-party module declares its version as a number or does not declare it at all
• Fix the Sentinel back-office menus staying in English on a shop in another language: tab labels are now translated at install, and existing tabs are translated on update

Documentation

Consulter la documentation complète

Release v2.7.0

• Add Two-Factor Authentication (free): authenticator application, passkeys, recovery codes and trusted devices, with an enrollment policy per employee profile — reminder, deadline, exemptions — and the employee status piloted from the back office or the command line. (#931)
• Redesign the back-office screens

Documentation

Consulter la documentation complète

Release v2.6.4

• Notify when a newer version of Sentinel is published: a banner on every Sentinel page and a line in the PrestaShop home widget link to the release
• Add an "I bought my module on Addons" link under the upgrade buttons
• Add a new event type "Detection Skipped" with the reason the check could not be completed.
• Fix back-office requests being processed twice by the security checks: each page was logged twice, counted twice by the rate limiter and inspected twice by the threat detector.

Documentation

Consulter la documentation complète

Release v2.6.3

• Improve the vulnerability scan: a scan that cannot complete now reports the reason instead of appearing to hang

Documentation

Consulter la documentation complète

Release v2.6.2

• Fix the auto prepend automatic installation: the protection file is now shipped with the module instead of being generated at install time, an auto_prepend_file already configured on the server is detected before anything is written, and the configuration is repaired on update

Documentation

Consulter la documentation complète