Craft Flare

Fixed

• Request context (URL, method, headers and body) reaches Flare again. Flare::make() only applies the client defaults when it is given an API token string, so passing a FlareConfig left every collector unregistered (#2).
• Set the application path, so Git information is collected and stack frames are trimmed to the project.

Added

• Added the censorCookies setting (defaults to true). Flare censors the Cookie header but reads the parsed cookies separately, so Craft's session ID and identity cookie were sent in the clear.
• Added loginName to the default censorRequestBodyFields. Craft's login form posts loginName, not username.
• Censored field names are matched up to two levels deep, so email now covers fields[email] as well. Use an explicit dot path for anything nested deeper.
• Credential fields (CRAFT_CSRF_TOKEN, password, newPassword, currentPassword, account-password, loginName) are censored whatever censorRequestBodyFields is set to, so projects that stored the setting before a field was added still do not post credentials.

Changed

• Dump collection stays off. The recorder swaps the global VarDumper handler, and this plugin builds the client while an exception is already being handled, so it can never record a dump.
• Stack frame argument collection stays off. It sets zend.exception_ignore_args to 0 process-wide, and on a production ini the exception is created before the client boots, so the trace carries no arguments either way.

Added

• Added the ignoredHttpStatusCodes setting (defaults to [403, 404]) to configure which HTTP status codes are filtered out before reporting.

Changed

• HTTP exceptions are now filtered by status code instead of exception class, so generic HttpException(403|404) throws from third-party code (e.g. verbb/wishlist) are filtered too, not just ForbiddenHttpException / NotFoundHttpException.

Changed

• Upgraded to spatie/flare-client-php v2.

Fixed

• Ensures error code is an integer.

Added

• Added queue handling exceptions.

Changed

• Improved reporting of fatal PHP errors.

Added

• Now also reporting fatal PHP errors.

Changed

• Now also filtering out ForbiddenHttpException and {% exit 403 %} Twig statements.

Added

• Ability to test error reporting via dedicated buttons on the settings page.

Changed

• No longer reporting {% exit 404 %} Twig statements, aligning with the existing filtering of NotFoundHttpException.

Fixed

• Fixed exception when Flare key was not provided

Added

• Ability to enable censoring queries

Added

• Ability to access the Flare instance via CraftFlare::getFlareInstance()

Fixed

• IP addresses in the request header were not correctly censored

Changed

• Refactoring to use a FlareService and gather system data after the Craft app is initialized

Fixed

• Catching non-initialized Flare instance

Added

• Added changelog

Fixed

• Accessing user data before init

• Initial release