Skip to content

v1.2.0

Choose a tag to compare

View all tags
@joetaylorjr joetaylorjr released this 20 Jan 23:50
· 6 commits to main since this release
v1.2.0
742904d

Changed

  • BREAKING: Requests with method override headers now receive 400 Bad Request instead of being silently processed
  • Early rejection strategy replaces header stripping to prevent upstream cache poisoning
  • Aggressive no-cache headers added to rejected requests to prevent Pagely ARES caching

Added

  • early_reject_override_requests() static method for immediate request rejection
  • Pagely-specific cache control headers (X-Accel-Expires, Surrogate-Control)
  • JSON error response body for rejected requests with method_override_not_allowed code
  • Expires header set to epoch for maximum cache prevention compatibility
  • GitHub auto-updater: Plugin now checks for updates from GitHub releases automatically
  • "View releases on GitHub" link added to plugin row meta on Plugins page
  • Plugin details popup shows release notes from GitHub

Security

  • Fixes incomplete cache poisoning mitigation where stripped headers still resulted in cacheable 200 responses
  • Addresses CVE-related finding where Pagely ARES cached responses without keying on X-Http-Method-Override header
  • 400 responses with no-store prevent poisoned entries from entering the cache layer

Deprecated

  • early_strip_headers() method (now calls early_reject_override_requests() for backwards compatibility)
Assets 2
Loading