Changelog for IskWaf.

3.2.2-pl
==============
- [New] Sample CSV files for importing blocking rules (core/components/iskwaf/elements/import-examples/): blocks-ip.csv, blocks-ua.csv, blocks-ref.csv, blocks-uri.csv with real-world signatures, plus a README describing the columns, field values, delimiter and import limits.

3.2.1-pl
==============
-- Fixed bugs

3.2.0-pl
==============
- [New] Request payload inspection (defence-in-depth against SQL injection and similar). Scans request inputs (GET/POST/Cookie and optionally the raw body) against configurable regex signatures. New settings: iskwaf_payload_inspection_mode (off/log/block, default off), iskwaf_payload_scan_sources, iskwaf_payload_max_body, iskwaf_payload_signatures (one regex per line; built-in SQLi set used when empty).
- [New] Hits are recorded in the IskWaf log (triggered_rule "payload") with the matched pattern, source, parameter and a sample; counted in daily reports.
- [Note] Disabled by default and recommended to run in "log" mode first to tune signatures before switching to "block". Input is normalized (raw/urldecode) before matching; matching is capped per request for performance.

3.1.1-pl
==============
- [New] Country whitelist (iskwaf_allowed_countries): if set, only the listed countries are allowed and all others are blocked (trusted search bots still pass). Takes precedence over the blacklist.
- [Improvement] ASN allow-lists (iskwaf_auto_allow_as_names / iskwaf_auto_allow_as_numbers) now have the highest priority: they are always checked in realtime (regardless of the realtime ASN block option) and before country blocking, so trusted companies are not blocked even when their country is blacklisted. Allow is now evaluated before block.
- [Improvement] Triggered-rule log notes now record details: for country blocks — the list (whitelist/blacklist), check mode and resolve source (table/ip2location_db); for ASN rules — what matched (allow/block by AS name/number) and the source.


3.1.0-pl
==============
- [New] Realtime country check mode (system setting iskwaf_country_check_mode): besides the cached mode (details table filled by cron), a 'realtime' mode resolves the country directly from the local IP2Location database on each new IP and blocks instantly, writing the result back to the details table.
- [New] Realtime ASN/AS-name rules (iskwaf_enable_realtime_asn_rules): instant block/allow by the same AS name/number lists as the cron, without waiting for the cron run.
- [Improvement] Reworked search bot verification into a hybrid method (iskwaf_bot_verification_method): fast local ASN check (IP2Location ASN) first, then rDNS+fDNS as a fallback; verified bots bypass country/ASN blocks. Positive result cached for 24h.
- [New] CSV export of rules (IP, User-Agent, Referrer, Request URI) from the manager, with a configurable delimiter (iskwaf_csv_delimiter, default ";").
- [New] CSV import of rules via the standard MODX file manager (media source), with per-row validation (IP/CIDR, pattern type, regex compilability, rule type), skip/update modes and an import summary.
- [Fix] Removed a leftover debug echo in the IP analysis cron script.

3.0.10-pl
==============
- The logic of the 'once_per_session' mode has been changed
- [Improvement] Updated the cron script to automatically create allow/block rules for /24 subnets based on Autonomous System (ASN) data.
- [New] Implemented country blocking, configurable via system settings.
- [New] Added a priority mechanism: trusted bots now bypass the country block.
- [Improvement] Optimized the SQL query in the cron script for stable performance with large log tables.

3.0.9-pl
==============

-- Added the ability to protect arbitrary PHP scripts via iskwaf-guard.php .
-- The code was refactored with logic removal to the IskWafService service class.

3.0.8-pl
==============
-- Fixed bugs

3.0.7-pl
==============
-- Fixed lexicons

3.0.6-pl
==============
-- Fixed bugs

3.0.5-pl
==============
-- Fixed bugs
-- Fixed the correct deletion of the component

3.0.4-pl
==============
-- Fixed bugs
-- Added work with geolocation databases
-- Fixed lexicons
-- Updated documentation
-- Added WAF operation modes

3.0.3-pl
==============
-- Added logging of POST requests

3.0.2-pl
==============
-- Fixed lexicons

3.0.0-pl
==============
-- The first release
