j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity
webvirtcloud/admin
History
catborise cf1cde376b fix: require POST for user block/unblock and OTP email, flag console cookie 
- user_block, user_unblock and admin_email_otp changed state on GET, so an
  <img> tag could lock a user out or trigger OTP emails through an
  admin's session. They now require POST; the buttons are CSRF forms.
- The console token cookie is set with httponly, SameSite=Lax and, on
  HTTPS, secure. Only novncd reads it; the page gets the token directly.
2026-10-02 22:44:00 +03:00
..
migrations Added Technicians group 2022-06-14 15:10:33 +02:00
templates/admin fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
__init__.py fix typo error 2022-09-05 15:36:37 +03:00
apps.py format python code with black 2022-11-02 08:54:35 +03:00
decorators.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
forms.py lint with black python. convert f style strings to old one. some small fixes 2020-11-05 12:34:31 +03:00
models.py format python code with black 2022-11-02 08:54:35 +03:00
permissions.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
tests.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
urls.py format python code with black 2022-11-02 08:54:35 +03:00
views.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00