sneak e2b47cd6e7 Core Rule Set: Drupal's JSON password reset passes (closes #259) ...

POST /user/password?_format=json with a name of python3, powershell,
ls -la or .htaccess was refused while bodies are read. On that path,
the JSON field name now skips 930120, 932120, 932250 and 932260, the
four rules those recorded names set off, unless the query has a
json.name parameter. Recorded from Drupal 11.4.11.

Model: opus-5-5

2026-11-09 22:37:14 +00:00

..

testdata

Core Rule Set: Drupal's JSON password reset passes (closes #259)

2026-11-09 22:37:14 +00:00

coreruleset_test.go

Core Rule Set: test concurrent requests keep their own exclusions

2026-11-09 20:59:45 +00:00

coreruleset.go

Core Rule Set: Drupal's ordinary requests pass by default (closes #236)

2026-11-09 19:57:53 +01:00

drupal_test.go

Core Rule Set: Drupal's JSON password reset passes (closes #259)

2026-11-09 22:37:14 +00:00

drupal.conf

Core Rule Set: Drupal's JSON password reset passes (closes #259)

2026-11-09 22:37:14 +00:00

gitea.conf

Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

2026-11-09 08:47:26 +01:00

wordpress.conf

Core Rule Set: WordPress's names and addresses pass on more fields (closes #245)

2026-11-09 21:58:18 +01:00