IskWaf - Web Application Firewall

IskWaf – Simple WAF for MODX 3. Site protection via IP, User-Agent, Referrer, URI rules (actions: block/CAPTCHA/allow). Includes logging, local CAPTCHA, and daily reports via CRON.

-- Fixed bugs

• [Fix] Search-engine bots (Yandex, Google, etc.) caused an HTTP 500 error during trusted bot verification when iskwaf_bot_verification_method was set to "dns" or "asn_dns".

• [New] Sample CSV files for importing blocking rules (core/components/iskwaf/elements/import-examples/): blocks-ip.csv, blocks-ua.csv, blocks-ref.csv, blocks-uri.csv with real-world signatures, plus a README describing the columns, field values, delimiter and import limits.

• [New] Request payload inspection (defence-in-depth against SQL injection and similar). Scans request inputs (GET/POST/Cookie and optionally the raw body) against configurable regex signatures. New settings: iskwaf_payload_inspection_mode (off/log/block, default off), iskwaf_payload_scan_sources, iskwaf_payload_max_body, iskwaf_payload_signatures (one regex per line; built-in SQLi set used when empty).
• [New] Hits are recorded in the IskWaf log (triggered_rule "payload") with the matched pattern, source, parameter and a sample; counted in daily reports.
• [Note] Disabled by default and recommended to run in "log" mode first to tune signatures before switching to "block". Input is normalized (raw/urldecode) before matching; matching is capped per request for performance.

• [New] Country whitelist (iskwaf_allowed_countries): if set, only the listed countries are allowed and all others are blocked (trusted search bots still pass). Takes precedence over the blacklist.
• [Improvement] ASN allow-lists (iskwaf_auto_allow_as_names / iskwaf_auto_allow_as_numbers) now have the highest priority: they are always checked in realtime (regardless of the realtime ASN block option) and before country blocking, so trusted companies are not blocked even when their country is blacklisted. Allow is now evaluated before block.
• [Improvement] Triggered-rule log notes now record details: for country blocks — the list (whitelist/blacklist), check mode and resolve source (table/ip2location_db); for ASN rules — what matched (allow/block by AS name/number) and the source.

• [New] Realtime country check mode (system setting iskwaf_country_check_mode): besides the cached mode (details table filled by cron), a 'realtime' mode resolves the country directly from the local IP2Location database on each new IP and blocks instantly, writing the result back to the details table.
• [New] Realtime ASN/AS-name rules (iskwaf_enable_realtime_asn_rules): instant block/allow by the same AS name/number lists as the cron, without waiting for the cron run.
• [Improvement] Reworked search bot verification into a hybrid method (iskwaf_bot_verification_method): fast local ASN check (IP2Location ASN) first, then rDNS+fDNS as a fallback; verified bots bypass country/ASN blocks. Positive result cached for 24h.
• [New] CSV export of rules (IP, User-Agent, Referrer, Request URI) from the manager, with a configurable delimiter (iskwaf_csv_delimiter, default ";").
• [New] CSV import of rules via the standard MODX file manager (media source), with per-row validation (IP/CIDR, pattern type, regex compilability, rule type), skip/update modes and an import summary.
• [Fix] Removed a leftover debug echo in the IP analysis cron script.