v1.5.0

Thanks to Tsvetan Stoychev (@ceckoslab), whose security review of 1.4.1 found everything in this release. Upgrading is recommended for every installation.

Security

• The bar is no longer inserted inside another template's script, style or comment. A page holding a literal </body> or </head> in inert script data could have that data run as HTML once the bar was added, which on admin pages meant XSS in an admin session. (#51, #57)
• Without an access key, the bar only answers loopback, private and link local addresses, and the storefront endpoints no longer return admin profiles. A developer mode server reachable from the internet now needs a key. (#52, #60)
• A key given in the URL redirects to the same address without it, and is stripped from the SEO tool links. (#53, #61)

Added

• A Trusted Proxies setting, so the IP allowlist and the wrong key lockout see the client behind a proxy. (#54, #58)

Changed

• Personal data keys (email, phone, telephone, dob, birth) are redacted. masked removes hex literals from captured SQL, none removes numbers too. (#55, #59)

Fixed

• Microdata property names such as __proto__ are read as ordinary properties, captured values can no longer break out of the Markdown report's code spans, and a failed permission change on profile files is logged. (#56, #62)