v3.0.0 - Security Hardening & Modern Refactor

🛡️ Major Security Refactor

This release marks a complete rewrite of the legacy timthumb.php script to address critical historical vulnerabilities (RCE, Local File Inclusion) while maintaining drop-in compatibility for legacy systems.

🔒 Security Improvements

• Strict MIME Type Validation: Now uses finfo to verify magic bytes instead of trusting file extensions.
• RCE Mitigation: Automatically secures the cache directory with .htaccess to prevent PHP execution.
• SSRF Protection: External image fetching (if enabled) is now restricted to HTTP/HTTPS protocols via cURL.
• Input Sanitization: Aggressive stripping of potentially malicious protocols (javascript:, data:) from source URLs.

💥 Breaking Changes

• Webshot Removed: The website screenshot functionality (dependent on exec and Xvfb) has been removed entirely due to security risks.
• Configuration: External sites are now disabled by default. You must explicitly enable allow_external in the configuration.
• Requirements: Now requires PHP 7.4+ and the fileinfo extension.

📦 Installation

If you are using Composer:

composer require ctrbts/secure-timthumb

Maintained by @ctrbts with AI-assisted code analysis for modern security standards.