Firewall for TYPO3 0.5.0
Updates the firewall engine to phirewall 0.9 and adds an event log browser to the backend module, opt-in logging for banned-key blocks, and an OPcache-backed compiled-data cache for the preset packages. TYPO3 14.3 is now covered by the CI test matrix.
Note
phirewall 0.9 replaces the OWASP-specific diagnostics header option with generic, matcher-provided diagnostic headers. If your config/system/phirewall.php calls enableOwaspDiagnosticsHeader(), switch to enableDiagnosticsHeaders() (the old call still works but is deprecated), and update flowd/phirewall-preset-owasp-crs to a release whose matcher emits the header itself.
Highlights
- phirewall 0.9 engine. Requests blocked because their key is already banned now dispatch the new
Fail2BanBlocked/Allow2BanBlockedevents, matcher-carried events expose theMatchResultthat triggered them, and diagnostic headers on blocked responses are now a generic mechanism any matcher can use (see the note above). - Event log browser. The backend module gained an Events view that lists the logged firewall events with a type filter, search and pagination. Diagnostic headers such as the matched OWASP CRS rule are stored in the event metadata, so you can see why a request was blocked without enabling the attacker-visible response headers.
- Banned-key block logging (opt-in). The new
fail2ban_blockedandallow2ban_blockedevent types log every request a banned client keeps hammering, with their own statistics label and chart color. They are high volume and therefore disabled by default; enable them in the logged event types of the extension configuration. - Compiled-data cache for presets (on by default). Preset packages (OWASP CRS, bad IPs) load their parsed rule data from OPcache-backed PHP artifacts instead of re-parsing it on every request. The artifacts live in the TYPO3 code cache directory (
var/cache/code/firewall) or a configurable path; the cache can be disabled in the extension configuration. - Unban works for preset rules again. Rule names containing dots (for example
preset.owasp-crs.fail2ban) put CSS metacharacters into the confirmation modal id, which left the unban button dead in the backend module. - TYPO3 14.3 in CI. Unit and functional tests now run against TYPO3 14.3 on PHP 8.3 to 8.5, and every quality check passes on both the TYPO3 12 and the TYPO3 13/14 toolchain. TYPO3 12.4 is tested with the latest dependencies only.
What's Changed
Engine & behavioral
- Require phirewall 0.9 by @sascha-egerer in #64
Features
- Log the phirewall banned-key block events by @sascha-egerer in #63
- Enable the compiled-data cache for preset packages by @sascha-egerer in #65
Bug fixes
- Use iteration indexes for unban modal ids by @sascha-egerer in #62
- Fix legacy extension build by @sascha-egerer in #61
Internal & packaging
- Open 0.5.0 development: alias dev-main to 0.5.x-dev by @sascha-egerer in #60
- Add TYPO3 14.3 to the CI test matrix by @sascha-egerer in #66
Full Changelog: 0.4.0...0.5.0
What's Changed
- Open 0.5.0 development: alias dev-main to 0.5.x-dev by @sascha-egerer in #60
- Use iteration indexes for unban modal ids by @sascha-egerer in #62
- Require phirewall 0.9 by @sascha-egerer in #64
- Log the phirewall banned-key block events by @sascha-egerer in #63
- Enable the compiled-data cache for preset packages by @sascha-egerer in #65
- Fix legacy extension build by @sascha-egerer in #61
- Add TYPO3 14.3 to the CI test matrix by @sascha-egerer in #66
Full Changelog: 0.4.0...0.5.0