3a4324fb6f
tests / pest (push) Failing after 7m54s
Details
tests / assets (push) Successful in 21s
Details
tests / release (push) Has been skipped
Details
── The hole ──────────────────────────────────────────────────────────────── There was no password reset. Fortify's feature was commented out, so there was no link on the sign-in form, no page and no route — a customer who forgot their password was locked out of their own cloud until somebody opened a shell. On a product whose selling point is that you can ring somebody, that is a support call a week and an embarrassing one. Two pages of ours under Fortify's route names (R1/R2), because with views off Fortify registers only the POST endpoints. The mail is a Mailable in this product's design rather than the framework's MailMessage: somebody who has just been locked out is exactly the person a phishing mail is aimed at, and a message that looks nothing like the rest of our post is one they cannot check — ours carries the footer that names our domains. Three decisions worth stating, each with a test: The answer is identical whether the address is known or not. "No account with that address" turns the form into a way of finding out who is a customer. The reset kills every other session. Whoever knew the old password may still be signed in somewhere, and a reset that leaves them there has fixed nothing. It does NOT sign the visitor in. The link arrived by email, and a mailbox somebody else can read would otherwise be a session somebody else gets. ── /sicherheit → /security ───────────────────────────────────────────────── R13: paths are English. Mine was not. The old path stays as a permanent redirect because it has already gone out in mail footers. ── One wordmark ──────────────────────────────────────────────────────────── "Sometimes it says Cloud and sometimes it does not" — correct. It was on the footer, the placeholder and the maintenance screen, and absent from the header, the sidebar and the sign-in plate. The product is called CluPilot Cloud; that is the name on the invoices and in every mail, so it is now the name everywhere. The console sidebar takes the small size so the lockup, the ADMIN badge and the close button still share one line (R18). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| admin.php | ||
| admin_incidents.php | ||
| admin_settings.php | ||
| auth.php | ||
| backups.php | ||
| billing.php | ||
| cloud.php | ||
| coming_soon.php | ||
| common.php | ||
| dashboard.php | ||
| datacenters.php | ||
| devices.php | ||
| domain.php | ||
| errors.php | ||
| finance.php | ||
| hosts.php | ||
| impersonate.php | ||
| instances.php | ||
| integrations.php | ||
| invoice.php | ||
| invoice_mail.php | ||
| invoices.php | ||
| invoices_admin.php | ||
| mail.php | ||
| mail_settings.php | ||
| maintenance.php | ||
| orders.php | ||
| plans.php | ||
| provisioning.php | ||
| reset_password.php | ||
| secrets.php | ||
| security.php | ||
| sessions.php | ||
| settings.php | ||
| status.php | ||
| support.php | ||
| two_factor_setup.php | ||
| updating.php | ||
| users.php | ||
| verify_email.php | ||
| vpn.php | ||