Firewall for TYPO3 0.8.0

This release makes the event log explain blocks instead of collecting request data: entries now carry the matcher metadata that led to the block, submitted POST parameters are no longer stored, and track events split into a per-hit and a threshold-reached type.

Highlights

• The event log shows why a rule matched. Every entry now carries the full match metadata of the firewall engine - rule id, rule message, the matched target (for example REQUEST_COOKIES:cart or REQUEST_HEADERS:User-Agent) and the value that triggered the rule (credential values stay redacted). With the bundled OWASP CRS preset 0.5.1 this turns an anonymous 942340 block into an actionable entry that names the offending cookie or parameter, ready for an excludeTarget() tuning decision.
• Submitted POST parameters are no longer stored. The event log records only what led to the match; the eventLogMaskParameters extension setting is gone (a leftover value in existing installations is ignored).
• Track events split into track_matched and track_threshold_reached. track_matched logs every hit of a track rule (high volume, off by default); track_threshold_reached logs when a track rule with a limit reaches it and is part of the default eventLogTypes. The old track_hit type is deprecated: a configured track_hit enables both successors and logs a deprecation; new entries are never written under the old type.
• The event view searches the whole log. The retention period no longer bounds what the module shows - it only drives the prune command. When entries older than the retention period still exist, the view shows a warning that firewall:eventlog:prune should be scheduled (TYPO3 scheduler or cron). Type filter tags now offer only event types that actually occur in the log; an active filter always stays visible so it can be toggled off.
• Classic-mode installations load the bundled libraries reliably. The TER artefact now ships the dumped Composer autoloader of the bundled libraries and loads it in classic mode; the bundle includes the OWASP CRS preset 0.5 line with the new match-debugging metadata.

Upgrade notes

• The eventLogMaskParameters extension setting was removed together with the POST parameter storage; no migration is needed, stale values are ignored.
• Replace track_hit in the eventLogTypes extension setting with track_matched and/or track_threshold_reached; until then the deprecated value keeps enabling both and logs a deprecation.
• The default eventLogTypes now include track_threshold_reached: installations without an explicit type list start logging an entry when a track rule with a limit reaches it.

What's Changed

• Log match metadata instead of the POST parameter dump by @sascha-egerer in #75
• Split track_hit into track_matched and track_threshold_reached by @sascha-egerer in #76
• Require the OWASP CRS preset 0.5 in the TER bundle by @sascha-egerer in #78
• Load the bundled vendor autoloader in classic mode by @sascha-egerer in #77
• Prepare the 0.8.0 release by @sascha-egerer in #79

Full Changelog: 0.7.0...0.8.0