mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
cf1cde376b
- user_block, user_unblock and admin_email_otp changed state on GET, so an <img> tag could lock a user out or trigger OTP emails through an admin's session. They now require POST; the buttons are CSRF forms. - The console token cookie is set with httponly, SameSite=Lax and, on HTTPS, secure. Only novncd reads it; the page gets the token directly. |
||
|---|---|---|
| .. | ||
| group_list.html | ||
| logs.html | ||
| user_form.html | ||
| user_list.html | ||