Firewall for TYPO3 0.6.0

Makes the patterns file location configurable, extends the event log to record the full request line and masked POST parameters, and validates all configurable directories against the allowed TYPO3 paths.

Highlights

• Configurable patterns directory. The new patternsDirectory extension setting moves phirewall.patterns.json and its lock file to another directory, for setups where config/system is read-only at runtime. The directory must lie within the TYPO3 project directory or BE/lockRootPath; other values are ignored with a logged warning.
• Full request line in the event log. Logged events now record the request target including the query string, so GET payloads such as injection attempts are visible in the backend module exactly as they arrived, and the module search finds them.
• POST parameters in the event details. Submitted POST parameters appear as post.name: value lines in the event details. Values are masked down to their first and last two characters (administrator becomes ad***or), parameter names that look like credentials are masked completely, and large forms are truncated with a _skipped marker. The new eventLogMaskParameters setting turns the value masking off (values are then stored in clear text, truncated to 256 characters) for setups that need to inspect POST payloads; credential-like parameters stay masked either way.
• Directory settings are validated. Both patternsDirectory and compiledCacheDirectory accept only paths within the TYPO3 project directory or BE/lockRootPath (checked with GeneralUtility::isAllowedAbsPath()), so path traversal or locations outside the allowed roots fall back to the default directory with a logged warning.

What's Changed

Features

• Make the patterns file directory configurable by @sascha-egerer in #67
• Log the query string and masked POST parameters by @sascha-egerer in #68

Bug fixes

• Restrict the compiled-data cache directory to the allowed TYPO3 paths by @sascha-egerer #70

Full Changelog: 0.5.0...0.6.0