boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
clusev/app/Models
History
boban 3a67aa99ec fix(auth): rotate remember_token on reset + atomic recovery-code use 
Address Codex security review:
- ForgotPassword + clusev:reset-admin now rotate remember_token, so a stolen
  remember-me cookie cannot survive a password reset (the email-token path
  already did this).
- useRecoveryCode reads/checks/removes under a row lock (DB transaction +
  lockForUpdate), so two concurrent requests can't both spend the same one-time
  code (replay).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 		2026-06-14 17:04:12 +02:00
..
AuditEvent.php feat: v1 data models + routes (Server/AuditEvent/SshCredential) 2026-06-12 06:25:47 +02:00
Server.php chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs 2026-06-13 12:54:26 +02:00
Setting.php feat(security): dashboard hardening, credential mgmt, system domain/TLS + channel, self-hardening 2026-06-13 02:25:23 +02:00
SshCredential.php chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs 2026-06-13 12:54:26 +02:00
User.php fix(auth): rotate remember_token on reset + atomic recovery-code use 2026-06-14 17:04:12 +02:00