webvirtcloud

j3d1/webvirtcloud

Fork 0

mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00

Commit graph

Author	SHA1	Message	Date
catborise	f94b3cee7a	chore: drop references to the local roadmap from code and tests Comments, docstrings and live test names cited item IDs of a roadmap that is not part of the repository. They now say what is meant, or nothing where the sentence stands without them. Test assertions and behavior are unchanged.	2026-10-04 11:09:25 +03:00
catborise	cf1cde376b	fix: require POST for user block/unblock and OTP email, flag console cookie - user_block, user_unblock and admin_email_otp changed state on GET, so an <img> tag could lock a user out or trigger OTP emails through an admin's session. They now require POST; the buttons are CSRF forms. - The console token cookie is set with httponly, SameSite=Lax and, on HTTPS, secure. Only novncd reads it; the page gets the token directly.	2026-10-02 22:44:00 +03:00

Author

SHA1

Message

Date

catborise

f94b3cee7a

chore: drop references to the local roadmap from code and tests

Comments, docstrings and live test names cited item IDs of a roadmap
that is not part of the repository. They now say what is meant, or
nothing where the sentence stands without them. Test assertions and
behavior are unchanged.

2026-10-04 11:09:25 +03:00

catborise

cf1cde376b

fix: require POST for user block/unblock and OTP email, flag console cookie

- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.

2026-10-02 22:44:00 +03:00

2 commits