8 Commits

Include renames

Author	SHA1	Message	Date
Dan MilneandClaude Opus 4	b876e02c3a	Hold TOTP enrollment secret server-side and email user on activation ... TOTP enrollment previously round-tripped the generated secret through a hidden form field and saved whatever the client submitted, letting an attacker with session access enroll a 2FA device they control by posting their own secret plus a matching code. Stash the secret in the session at GET /totp/new, read it only from the session at POST /totp, and drop the hidden field from the view. Notify the user by email on successful enrollment so unauthorized activations are visible even if a new vector appears later. Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>	2026-04-20 18:17:50 +10:00
Dan Milne	93a0edb0a2	StandardRB fixes	2026-01-01 13:29:44 +11:00
Dan Milne	67f28faaca	Improve some front end views. More descriptive error condition reporting. Updates to CLINCH_HOST for better WEBAUTHN	2025-11-12 16:24:05 +11:00
Dan Milne	52cfd6122c	Typo. More tests	2025-10-26 20:42:18 +11:00
Dan Milne	227e29ce0a	Fix/add some tests. Configure email sending address	2025-10-26 20:13:39 +11:00
Dan Milne	39757a43dc	Add an invite system	2025-10-24 23:26:07 +11:00
Dan Milne	56f7dd7b3c	First crack	2025-10-23 16:45:00 +11:00
Dan Milne	1ff0a95392	First commit	2025-10-23 16:19:56 +11:00