- Added support for Craft 5
- Fixed missing property declaration for Toolmate's minify service
- ToolMate now removes any hard-coded nonces or hashes set in the CSP config, for any directives that also contain the
unsafe-inlinepolicy - ToolMate now avoids inadvertently creating CSP directives that could be empty, when adding nonces
- Craft domains (i.e. Craft ID and the plugin store API) are now automatically included in the
connect-srcdirective for control panel requests unsafe-inlinedirectives are now added automatically for Yii error pages
- Fixes an issue where unhashed CSP nonces would not be included in the actual CSP header, on Craft 4.0
- Refactored logic concerning how and when the CSP header is set
- Fixed an issue where ToolMate failed to include the
'unsafe-inline'policy resource for thestyle-srcCSP directive, for site requests where the Yii debug toolbar is enabled
- Fixed issue in Settings introduced in the Craft 4 refactoring.
- Fixed an issue where $_csp didn’t have a default value which caused error.
- Fixed an issue with
schemaVersionin main plugin file being typed too hard.
- Added support for Craft 4
- ToolMate now requires PHP 8.0+
- Fixes an issue where Toolmate wasn't able to set the public web root path correctly
- Added
Settings::cspfor configuring the Content-Security-Policy header - Added the
cspNonce()Twig function for outputting a CSP nonce attribute or value
- Added
Settings::embedCacheDuration, which controls the cache duration for successful video embed responses, and (defaults tocraft\config\GeneralConfig::cacheDuration) - Added
Settings::embedCacheDurationOnError, which controls the cache duration for unsuccessful video embed responses (default 5 minutes) - Added support for a
cache_durationparameter for theToolmateVariable::getVideoEmbed()andgetVideoEmbed()Twig function, which can be used to override the cache duration in Toolmate's settings - Added a boilerplate
config.phpto the plugin repo
- ToolMate now caches unsuccessful video embed responses separate from successful video embed responses
Settings::publicRootnow defaults to the@webrootalias, and falls back on$_SERVER['DOCUMENT_ROOT']
- Fixes an issue where ToolMate would cache video embed request responses for much longer than intended
- Toolmate now does logging to its own log file
storage/logs/toolmate.log
- YouTube embeds will always set
rel=0to prevent YouTube from pulling in "related" videos from other channels when the video ends
- Fixed issue where oembed URL's didn't use https.
- Fixed issue with empty maxwidth oembed param
- Initial public release