v9.7.4
LatestVerified SafeReleased 1.2 MB
Added
- Timestamps in the fail2ban log now follow the operating system timezone instead of UTC, so fail2ban can correctly evaluate failed login attempts on servers using a non-UTC timezone.
- Added the constant CERBER_LOG_TIMEZONE to force an explicit timezone identifier for the fail2ban log when automatic detection cannot determine the system timezone.
Improved
- Hostnames written to the fail2ban log on failed login attempts are now sanitized to strip log-forging characters, allow only hostname-safe characters, and keep each entry on a single well-formed line.
- WP Cerber's admin interface now uses WordPress's --wp-admin-theme-color custom property instead of hardcoded accent colors, aligning tabs, focus states, and changelog callouts with the selected admin color scheme.
- The Tools / License page now shows localized, non-contradictory notices for empty, malformed, invalid, expired, or temporarily unverifiable license keys.
- Refactored database operations with the new CRB_Database and CRB_Query_Builder classes for more consistent query execution, transactions, safe value quoting, and validation.
- Added the Revalt result/error type as an internal foundation for more consistent operation results, diagnostic chains, and error logging.
- Traffic Inspector now validates decoded JSON request payloads and captures decoding errors for more reliable request logging.
- Sensitive-field masking and request-field preparation now use stricter validation, normalization, and escaping before database insertion.
- Admin notices emitted by WP Cerber are now rendered through crb_purify_message(), which allows only a defined set of HTML elements and attributes.