141bdeb89c
case 4710 - 2FA step requires the temp token from the password step
...
The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).
Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 11:28:17 -07:00
87a4946500
case 4586 - fuck it, everything is interdependent, just went for it, mostly buildable just reporting to fixup then testing after this
2024-05-09 22:56:53 +00:00
e06334a175
More subscription license work allow logins addition
2022-08-23 21:41:20 +00:00
0016204582
2022-08-23 16:56:20 +00:00
353a6072be
2022-03-04 20:24:42 +00:00
9f02542244
2022-03-04 19:03:57 +00:00
1e7369382e
2022-03-04 18:41:49 +00:00
5ef6aeb786
2022-03-02 23:15:44 +00:00
b75d46324f
End User License consent system added
2022-02-12 00:50:51 +00:00
91de021846
regression error with wolist after update, added regression test (and testability change to datatable refresh button) before fixing
2021-12-16 18:11:54 +00:00
83061fce6a
2021-11-12 19:19:22 +00:00
000b53ea1e
Adjusted jwt access token exp expiry value to 5 days from seven, also confirmed it works and an expired token loses access and adjusted the skew to 0
2021-11-12 18:10:39 +00:00
eba68efc19
licensing stuff
2021-11-11 23:54:50 +00:00
9ad70efb06
license lockout handling code for when db has more active users than license allows for
2021-10-18 18:09:15 +00:00
f2712900cd
2021-10-18 17:41:05 +00:00
95d2ac89b7
just started testing with new .net core v6 fixed some minor issues with UTC dates in light of new npgsql thing
2021-10-15 23:31:28 +00:00
ec67ecab23
2021-09-30 23:41:56 +00:00
56d8cc27cb
Renamed roles and trans keys "Limited"->"Restricted" "Full" -> ""
2021-07-12 17:19:09 +00:00
9a9dae5aea
2021-06-16 19:30:19 +00:00
e47712d0d8
2021-06-16 00:02:41 +00:00
dfe7d990ad
2021-06-15 23:36:22 +00:00
741c2e72e9
2021-06-15 22:00:02 +00:00
0c0169d6b2
2021-03-12 21:54:48 +00:00
5c6cf1939b
2021-03-12 21:37:38 +00:00
61c64dbcf4
2021-03-12 21:28:07 +00:00
27a9509be1
2021-03-12 19:18:03 +00:00
910fbaa182
2021-03-12 18:53:59 +00:00
eedc4bd54f
2021-03-12 18:50:20 +00:00
1dc7d73bb9
2021-03-12 17:57:50 +00:00
00497abf6a
2021-03-12 15:59:47 +00:00
fee905a1ed
2021-03-12 01:38:29 +00:00
ce4a33ce3c
2021-03-12 01:12:03 +00:00
df2491f95f
2021-03-12 00:48:37 +00:00
ca98e859b1
2021-03-12 00:09:57 +00:00
097c331efb
2021-03-11 20:00:42 +00:00
be14484ba6
2021-03-11 19:33:41 +00:00
f777e70e33
2021-03-11 18:23:20 +00:00
0ae69f6591
2021-03-11 18:06:38 +00:00
eec26f92de
2021-03-03 00:50:15 +00:00
68ee6f411a
2020-12-07 18:11:16 +00:00
d913c7f216
2020-11-20 00:07:31 +00:00
0467f5f185
2020-11-19 23:25:21 +00:00
d991c0abad
2020-11-19 16:11:56 +00:00
fbc84c76ae
2020-11-19 16:06:50 +00:00
a255aab73c
2020-11-19 00:55:47 +00:00
b9f35d9d79
2020-09-07 15:50:24 +00:00
40b705b75a
2020-06-18 21:31:44 +00:00
746f60af15
2020-06-10 23:51:25 +00:00
ff20c44710
2020-06-10 14:40:12 +00:00
4b876f54ca
2020-06-10 13:33:38 +00:00
