catborise cf1cde376b fix: require POST for user block/unblock and OTP email, flag console cookie ... - user_block, user_unblock and admin_email_otp changed state on GET, so an <img> tag could lock a user out or trigger OTP emails through an admin's session. They now require POST; the buttons are CSRF forms. - The console token cookie is set with httponly, SameSite=Lax and, on HTTPS, secure. Only novncd reads it; the page gets the token directly.		2026-10-02 22:44:00 +03:00
..
migrations	Added Technicians group	2022-06-14 15:10:33 +02:00
templates/admin	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00
__init__.py	fix typo error	2022-09-05 15:36:37 +03:00
apps.py	format python code with black	2022-11-02 08:54:35 +03:00
decorators.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
forms.py	lint with black python. convert f style strings to old one. some small fixes	2020-11-05 12:34:31 +03:00
models.py	format python code with black	2022-11-02 08:54:35 +03:00
permissions.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
tests.py	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00
urls.py	format python code with black	2022-11-02 08:54:35 +03:00
views.py	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00