tech
released this
2026-08-10 10:42:28 +00:00
| 104 commits to main since this release
- Fixed a serious bug: the Firewall could block ordinary visitors just for arriving from an
everyday link -- for example, a link shared on Facebook, whose own redirect URL happened to
match a pattern the Firewall treated as suspicious. The underlying cause was broader than that
one case: 132 of the Firewall's 137 protection rules were checking a visitor's Referer,
User-Agent, and X-Forwarded-For information -- values a visitor doesn't control -- when they
should only ever have been checking what a visitor actually submits (search terms, form fields,
comments, and similar). Those three values are now excluded everywhere except the handful of
rules that specifically need them (Log4Shell-style attacks are delivered through exactly those
values, so detection there is unchanged). No settings change needed; this takes effect
automatically.
Downloads