John Cardinal 141bdeb89c case 4710 - 2FA step requires the temp token from the password step ...

The 2FA step matched the user by temp token alone, and the token was left
empty after a successful 2FA login (null right after turning 2FA on), so an
empty or missing token skipped the password step (security review F5).
Now: an empty or missing temp token is refused before the lookup; the token is
cleared to null after success; after 5 wrong codes the token is cleared, so the
password must be entered again (counted in memory per user).

Changelog: general security notice for self-hosted upgrades, and the one
behaviour change users can see. SECURITY-REVIEW.md: F5 fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 11:28:17 -07:00

.vscode

case 4690 - retarget net10.0; framework-matched Microsoft.* 10.0.13, Npgsql EF 10.0.3

2026-10-22 14:50:47 -07:00

ayanova.tests

case 4690 - licence verification gate: ayanova.tests runs every v8 fixture key through License.Parse

2026-10-22 15:22:04 -07:00

custom-work

2023-01-21 01:23:19 +00:00

devdocs

case 4710 - 2FA step requires the temp token from the password step

2026-10-24 11:28:17 -07:00

dist

case 4690 - Windows network install: official PostgreSQL download link (installer and manual); examples for PostgreSQL 18

2026-10-23 16:06:27 -07:00

docs/8.0

case 4710 - 2FA step requires the temp token from the password step

2026-10-24 11:28:17 -07:00

graphics

Raster versions of logos used to make an invoice for TNT medical might be useful again not code related

2023-02-15 00:11:01 +00:00

server/AyaNova

case 4710 - 2FA step requires the temp token from the password step

2026-10-24 11:28:17 -07:00

.gitignore

case 4690 - build-release.bat: copy all output to build-output.txt; UTF-8 for MkDocs when piped

2026-10-23 11:37:29 -07:00

build-release.bat

case 4690 - build-release.bat: copy all output to build-output.txt; UTF-8 for MkDocs when piped

2026-10-23 11:37:29 -07:00

CLAUDE.md

Security review pass 1: scope, threat model, attack-surface map, first candidate findings

2026-10-23 18:00:18 -07:00

dev-raven.bat

case 4690 - version bump and confirmation of choices for net10-port

2026-10-22 12:38:37 -07:00

Dockerfile.docs

Case 4641 AI era starts now

2026-02-02 02:48:54 +00:00

makedocs.bat

Fix for issue that suddenly appeared for reasons I can't determine in which the corp docs hosted site stopped working with the same manual build I've always been using as it started to try to find the links from the root of the site instead if relatively in the docs folder. Adding the site_url seems to have fixed this issue and doesn't break a local install copy of the docs from within AyaNova so this seems to be resolved.

2024-05-03 22:35:35 +00:00

raven.sln

case 4642

2026-02-13 09:13:54 -08:00

servcustdocs.bat

customer docs

2022-03-31 22:35:14 +00:00

servdocs.bat

2022-03-22 20:09:17 +00:00

startsql.bat

2023-05-02 22:12:23 +00:00

Description

No description provided

178 MiB

Languages

C# 99.6%

JavaScript 0.2%

Batchfile 0.2%