0.9.0

Firewall for TYPO3 0.9.0

This release turns the event log into a working surface for analyzing and stopping an ongoing attack

Highlights

• See at a glance who is blocked. A red lock icon next to a key in the event log marks clients that are blocked right now - by an active fail2ban/allow2ban ban or by an ip/cidr entry on the pattern blocklist. It works for hash-only keys too.
• Act directly from the event log. Every key row offers actions to filter the list to that key, hide noisy keys behind removable chips, and block the displayed IP as an exact pattern entry after a confirmation dialog. Blocking is only offered when the shown address verifiably is the complete key, so anonymized addresses can never be blocked by accident.
• Time ranges keep the view fast. The event log covers the last 7 days by default and switches between 24 hours, 7 days, 30 days, and the whole log; combined with leaner queries and a new index, large event tables stay responsive.
• Targeted full-IP logging for attack analysis. The new eventLogFullIpRules setting stores unanonymized client IPs for exactly the rules under investigation. A warning icon in the view and a System > Status report warn while the exception is active, so it is not forgotten.
• Capture the complete request. The new opt-in eventLogRequestHeaders setting records all request headers with each event - read from the raw server environment, with credential headers redacted - and shows them collapsed in the event details.
• Expired block patterns stop matching immediately. Entries past their expiry date no longer block requests until the next prune run.
• Ready for TYPO3 v15. All core API calls deprecated for v15 were replaced while keeping support for TYPO3 12.4, 13.4, and 14.

Upgrading

Update the database schema (new index on tx_firewall_event) and flush all caches after the upgrade, for example with vendor/bin/typo3 extension:setup followed by vendor/bin/typo3 cache:flush. See the "Upgrade from 0.8" section in the Installation chapter for the behavioral changes to review.

What's Changed

• Extend the event log with key actions, time ranges and logging options by @sascha-egerer in #81
• Prepare the 0.9.0 release by @sascha-egerer in #82

Full Changelog: 0.8.1...0.9.0