v1.0.5

• AGENTS.md: Step 0 — grep tiger-core/CAPABILITIES.md before building anything; core probably already has it.

No runtime change.

v1.0.4

• README: replaced a stale "early beta" label with a description of what the module does; the release page now shows the corrected README.

No runtime change.

1.0.3

An advisory WAF match no longer masks custom enforcement (TIGER-82).

inspect() returned on the first shipped match. A soft category is capped at log, waf.action itself defaults to log, and custom admin rules were only evaluated when nothing shipped had matched at all. So a request matching both a shipped heuristic and an administrator's custom block rule was allowed — the observe-only verdict shadowed the policy that said block.

An advisory rule may inform, never mask. Everything is now evaluated and the strongest action wins (log < captcha < block), short-circuiting only on a block. Learn/off mode and the outage fail-open are unchanged.

Also adds a test suite and CI — this module shipped with neither, and its enforcement logic just changed. 7 tests running on PHP 8.1 and 8.4, including controls in the opposite direction: an advisory match alone stays advisory, and a log-only custom rule cannot soften a shipped block.

1.0.2

Fixes a permanent "update available" loop.

The manifest said 1.0.0 while the release was tagged v1.0.1. Tiger_Update_Checker compares the version recorded at install — which comes from module.json — against the newest GitHub release. So the update ran, applied v1.0.1 correctly, read the manifest, wrote back 1.0.0, and the checker went on offering v1.0.1 forever. The update could never satisfy itself.

Observed on dev-com as ref=v1.0.1 sitting alongside version=1.0.0.

• module.json bumped to 1.0.2 so it matches the tag
• Added the Version check workflow tiger-core has always had, which fails a tag build when the two disagree — the guard the module repos never got, which is why three drifted in the same batch

No code changes. Updating to 1.0.2 clears the loop.

v1.0.1

1.0.1 — the marketplace listing blurb is now translated.

Adds <slug>.listing.description in all six locales (en/es/pt/hi/de/fr). The public directory pulls this key from the module's own languages/ at the pinned ref, so this repo stays the single source of truth for its own copy.

TigerShield 1.0.0

1.0 — the WAF ships stable alongside Tiger 1.0.

CrowdSec IP blocking, brute-force/login protection, rate limiting, a WAF ruleset with custom rules, and captcha clearance — with a Learn mode default and fail-open behaviour, so it never takes your site down to protect it.

Ships the full six-locale UI (en/es/pt/hi/de/fr), dashboard widget included. No behaviour change from 0.8.0.

v0.8.0 — full localization (es/pt/hi/de/fr) + keyed dashboard widget

Full localization. TigerShield now ships its own translations for es, pt (pt-BR), hi (Devanagari), de, and fr (alongside en). The admin UI and the security dashboard widget render in the active locale — autonomous modules own their i18n.

Fixed — dashboard widget was English-only + leaked a raw key. The Shield widget hardcoded every body string in render() and its title showed the raw tigershield.dashboard.title key on non-English admins. Every label now routes through the translator via owner-namespaced tigershield.* keys, with an active→en→key fallback so it never shows a key.

v0.6.0-beta — custom WAF rules + body scanning

Phase 5.1 of the request WAF.

Added

• Custom WAF rules — a tigershield_rule store + a /tigershield/admin/rules editor (DataTables grid + create/edit modal). Match one request surface (path / query / path+query / User-Agent / method / body) by a literal substring or a regex, with the rule's own action (log / captcha / block — not tier-capped like the shipped soft heuristics). Rules run after the shipped ruleset (first match wins).
• No DB on the hot path — the DB is the source of truth; every write recompiles the active rules to storage/cache/tigershield/waf-custom.json, which the gate reads (one-shot lazy rebuild on a miss) — the same discipline as the CrowdSec blocklist. Tigershield_Service_Rules (datatable / save / toggle / delete) recompiles on every mutation; regex rules are validated on save.
• POST-body scanning (opt-in) — the content categories (traversal / RCE / SQLi / XSS) and any body-targeted custom rule also match form-field values. Off by default (waf.body.enabled); a rich-content skip list (waf.body.skip) plus always-skipped password / CSRF / captcha fields hold down false positives.

Changed

• Tigershield_Service_Waf::inspect() resolves the action itself (returns {label, action}); the gate uses it directly.

Verified

• 17-assertion harness on tiger-dev: custom literal/regex matches + actions, disabled-rule skip, body scanning + skip-list + always-skip fields, shipped body categories, shipped-rule regression, and a benign battery — 0 false positives.

Free · BSD-3-Clause.

v0.5.0-beta — request WAF

Phase 5 — a curated request WAF that screens each request's content (path / query / User-Agent / method) for attack signatures. The last engine in the gate pipeline; ships log-only.

Added

• Tigershield_Service_Waf + rules/default-waf.php — a curated, high-signal ruleset in 9 admin-togglable categories: sensitive-file & CMS probes, path traversal / LFI, command injection, null bytes, disallowed methods, scanner user-agents, and (log-only) SQLi/XSS heuristics. Literal strpos before regex, query capped at 4KB, first-match wins.
• Wired into the gate (_wafDecision, runs last, skips assets). High-confidence categories obey waf.action (log/captcha/block); soft SQLi/XSS heuristics are hard-capped at log-only and never auto-block.
• A new log gate verdict (observe-only): recorded to the event log, never enforced even in enforce mode.

Notes

• v1 does not scan POST bodies (the main false-positive source) — deferred to 5.1 with a tigershield_rule custom-rule editor.
• ~15µs/request worst case; 0 false positives on a benign test battery (legit URLs containing select/union/<b>/curl).

v0.4.0-beta — Live Traffic + security dashboard widget

Added

• Live Traffic view (/tigershield/admin/events) — a server-side DataTables grid over the event log (time, IP, country, action, reason, route) with search + an action filter. (Fixes the widget's "View live traffic" link, which 404'd.)
• Dashboard widget — the "security is working" tables (WordFence-style): Top offending IPs (with geolocated country), Top countries, and Top targeted logins (account / tries / real-user flag), over the last 7 days. Always shown, with a "No data yet." empty state and WordFence-style table heads.

Fixed

• Live Traffic DataTables error ("No action was specified") — the toolbar filter key collided with the /api dispatch action field; renamed to event_action.

Notes

• Requires tiger-core ≥ 0.10.0-beta for the dashboard grid; the widget's reCAPTCHA controls need ≥ 0.9.0-beta (both degrade gracefully on older cores).