Skip to content

CHANGELOG.md

Latest commit

 

History

History
63 lines (49 loc) · 2.71 KB

CHANGELOG.md

File metadata and controls

63 lines (49 loc) · 2.71 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

1.1.0 - 2026-09-02

Added

  • Request filtering: REQUEST_LOG_METHODS (limit logged HTTP methods), REQUEST_LOG_INCLUDE_PATHS (regex allow-list) and REQUEST_LOG_EXCLUDE_PATHS (regex deny-list) so not every GET / ends up in the log.

Fixed

  • Documentation: the array hook format in hooks.php never worked for Composer namespaced classes (CI_Hooks::_run_hook() bypasses autoloaders and require_onces the configured file path). The README, hook docblock and sample now use the working closure registration format.
  • Documentation: added an explicit .env loading section — CI3 does not parse .env files, so REQUEST_LOG_* must be exposed via vlucas/phpdotenv, Apache SetEnv, or Nginx fastcgi_param.
  • Documentation: added note about custom Composer vendor-dir (e.g. application/third_party/vendor) and pointing $config['composer_autoload'] at the exact autoload path.

1.0.1 - 2026-09-02

Fixed

  • Logs could be fetched directly from the browser. Added deny rules:
    • sample/application/logs/.htaccess and sample/application/uploads/.htaccess that block direct access (Apache 2.2/2.4) including a *.log / *.gz guard.
    • New "Security" section in the README covering moving application/ out of the web root, pointing REQUEST_LOG_DIR outside the document root, and Apache/Nginx deny configuration.

1.0.0 - 2026-09-02

Added

  • Initial release: CI3 post_controller_constructor hook RequestLogHook that captures request metadata — headers, raw body, file uploads, client IP, user agent, query string — and writes one JSONL line per request to application/logs/analysis.log.
  • RequestLogService with sensitive-field redaction (configurable via REQUEST_LOG_REDACT_FIELDS), body truncation (3 MB default), file metadata extraction (name, size, MIME, SHA-256 hash, double-extension detection), and IP/CIDR whitelist.
  • RequestLog config class that reads REQUEST_LOG_* environment variables with sensible defaults.
  • Daily log rotation with gzip compression and retention pruning (REQUEST_LOG_RETENTION_DAYS, default 30).
  • Sample CI3 application under sample/ with a Home controller demonstrating JSON POST and multipart file upload endpoints.