Skip to content

v1.3.0

Choose a tag to compare

View all tags
@aregowe aregowe released this 20 Apr 13:33
· 15 commits to main since this release
1.3.0
3e41c10
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's New

Configurable Allowed & Blocked Extensions (#3)

File upload extension policies are now configurable via the Magento admin panel at Stores > Configuration > PolyShell Protection without requiring code changes.

  • Additional Allowed Extensions — comma-separated list of extra extensions to permit (e.g. ai, psd, svg).
  • Additional Blocked Extensions — comma-separated list of extra extensions to block (e.g. svg, swf, html). The blocklist always overrides all allowlists.
  • Base code-defined allowlist and blocklist are displayed as read-only notes in the admin UI.
  • rar added to the base allowed extensions.

Plugin Behavior Changes

  • ValidateUploadedFileNamePlugin and ValidateCustomOptionUploadPlugin now validate filenames against the merged allowlist/blocklist via FileUploadGuard::assertSafeFileName() instead of unconditionally blocking all custom option file uploads. Safe files pass through; dangerous files are blocked with a logged warning.

New Files

  • etc/acl.xml — ACL resource for admin config access.
  • etc/config.xml — Default configuration values.
  • etc/adminhtml/system.xml — Admin UI for extension configuration.

Internal

  • FileUploadGuard now depends on ScopeConfigInterface for reading admin-configured extensions.
  • ALLOWED_EXTENSIONS renamed to BASE_ALLOWED_EXTENSIONS (public).
  • New BASE_BLOCKED_EXTENSIONS constant and getAllowedExtensions() / getBlockedExtensions() methods.
  • Updated README and copilot-instructions with admin configuration documentation.
Assets 2
Loading