Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with
python3, powershell, ls -la and .htaccess. Fixes in ghost.conf:
- the eight rules that refused words naming commands and files, now with
932235, for staff profiles, setup, invitations, tiers, offers,
recommendations, integrations, webhooks, feature images, members'
comments, the CSV import's labels, ActivityPub and the analytics' query
fields;
- 932235 for the existing plain-text fields and code injection, so
"powershell & python3" passes there and as a site's title;
- filter skips six more command rules, for the post picker's
title:~'powershell & python3';
- staff invitation addresses, email_segment, a tag's canonical_url, and
ActivityPub's handles, actorUri and domain;
- a tag's code injection skips what a post's does, 941110 included.
Model: opus-5-5
Ghost 6.76.0's ordinary traffic, recorded in `testdata/ghost-requests.txt`,
passes at the default settings and while bodies are read. It covers public
pages, members' sign-up and sign-in, the admin, the editor saving and
publishing posts and pages with code blocks and HTML cards, tags, settings,
staff invitations, uploads, newsletter settings, and both APIs. Ghost's
fixes, in the new `ghost.conf`, let through `filter`, the member `search`
and the embed `url` in the query, and plain text, addresses, articles, code
injection and passwords in JSON bodies. A `<script>` element and a
`javascript:` link stay refused in articles and code injection. `SWW_APPS`
names Ghost `ghost`. `README.md` lists Ghost; `SPEC.md` lists its fixes.
Model: opus-5-5
clawbot
clawbot