- Added support for Craft 5
- Fixed missing property declaration for Toolmate's minify service
- ToolMate now removes any hard-coded nonces or hashes set in the CSP config, for any directives that also contain the
unsafe-inline
policy - ToolMate now avoids inadvertently creating CSP directives that could be empty, when adding nonces
- Craft domains (i.e. Craft ID and the plugin store API) are now automatically included in the
connect-src
directive for control panel requests unsafe-inline
directives are now added automatically for Yii error pages
- Fixes an issue where unhashed CSP nonces would not be included in the actual CSP header, on Craft 4.0
- Refactored logic concerning how and when the CSP header is set
- Fixed an issue where ToolMate failed to include the
'unsafe-inline'
policy resource for thestyle-src
CSP directive, for site requests where the Yii debug toolbar is enabled
- Fixed issue in Settings introduced in the Craft 4 refactoring.
- Fixed an issue where $_csp didn’t have a default value which caused error.
- Fixed an issue with
schemaVersion
in main plugin file being typed too hard.
- Added support for Craft 4
- ToolMate now requires PHP 8.0+
- Fixes an issue where Toolmate wasn't able to set the public web root path correctly
- Added
Settings::csp
for configuring the Content-Security-Policy header - Added the
cspNonce()
Twig function for outputting a CSP nonce attribute or value
- Added
Settings::embedCacheDuration
, which controls the cache duration for successful video embed responses, and (defaults tocraft\config\GeneralConfig::cacheDuration
) - Added
Settings::embedCacheDurationOnError
, which controls the cache duration for unsuccessful video embed responses (default 5 minutes) - Added support for a
cache_duration
parameter for theToolmateVariable::getVideoEmbed()
andgetVideoEmbed()
Twig function, which can be used to override the cache duration in Toolmate's settings - Added a boilerplate
config.php
to the plugin repo
- ToolMate now caches unsuccessful video embed responses separate from successful video embed responses
Settings::publicRoot
now defaults to the@webroot
alias, and falls back on$_SERVER['DOCUMENT_ROOT']
- Fixes an issue where ToolMate would cache video embed request responses for much longer than intended
- Toolmate now does logging to its own log file
storage/logs/toolmate.log
- YouTube embeds will always set
rel=0
to prevent YouTube from pulling in "related" videos from other channels when the video ends
- Fixed issue where oembed URL's didn't use https.
- Fixed issue with empty maxwidth oembed param
- Initial public release