Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359) #369

Open
clawbot wants to merge 1 commits from issue-359-ghost-remaining-fields into next
pull from: issue-359-ghost-remaining-fields
1 Commits
Author SHA1 Message Date
clawbot 1aee099fd4 Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359)
check / check (push) Waiting to run
Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with
python3, powershell, ls -la and .htaccess. Fixes in ghost.conf:

- the eight rules that refused words naming commands and files, now with
  932235, for staff profiles, setup, invitations, tiers, offers,
  recommendations, integrations, webhooks, feature images, members'
  comments, the CSV import's labels, ActivityPub and the analytics' query
  fields;
- 932235 for the existing plain-text fields and code injection, so
  "powershell & python3" passes there and as a site's title;
- filter skips six more command rules, for the post picker's
  title:~'powershell & python3';
- staff invitation addresses, email_segment, and ActivityPub's handles and
  domain;
- a tag's code injection skips what a post's does, 941110 included.

Model: opus-5-5
2026-11-12 05:48:54 +00:00