catborise cf1cde376b fix: require POST for user block/unblock and OTP email, flag console cookie ... - user_block, user_unblock and admin_email_otp changed state on GET, so an <img> tag could lock a user out or trigger OTP emails through an admin's session. They now require POST; the buttons are CSRF forms. - The console token cookie is set with httponly, SameSite=Lax and, on HTTPS, secure. Only novncd reads it; the page gets the token directly.		2026-10-02 22:44:00 +03:00
..
admin	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00