4 Commits

Include renames

Author	SHA1	Message	Date
sneak	0de82da1a8	Read every setting through viper and rename the settings (closes #211) ... Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-12 04:13:28 +00:00
clawbot	4b62bc84ce	SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220) ... Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5	2026-11-12 03:15:16 +01:00
clawbot	db0912b335	Core Rule Set: random passwords pass on the remaining password fields (closes #288) ... Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password on the pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset, change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5	2026-11-10 19:57:58 +01:00
clawbot	2d83961900	Core Rule Set: Vaultwarden's ordinary requests pass by default (closes #239) ... Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to 900153. On Vaultwarden's account, organization and admin paths, names and password hints skip 930120, 932120, 932250 and 932260, and so does a security key's name. Email addresses skip 930120, 932120 and 932260 there, on the two-factor email paths and when signing in with another device. So does the address of the admin page's test email. The data breach report's address does too. The encrypted names of uploaded attachments and file sends skip 920120. Requests recorded from Vaultwarden 1.37.5 through the web vault, the Bitwarden command line client and the admin page pass at the defaults and while bodies are read. Model: opus-5-5	2026-11-10 07:26:13 +01:00