0d8c94bf82
- Fix 3 missing CSRF tokens on admin user delete/reset and account
key delete forms (were broken — CSRFProtect rejected submissions)
- Fix trust store path traversal: untrust_key() now validates
fingerprint format ([0-9a-f]{32}) and checks resolved path
- Fix chain key rotation: old key is now revoked after rotation
record, preventing compromised old keys from appending records
- Fix SSRF in deadman webhook: block private/internal IP targets
- Fix logout CSRF: /logout is now POST-only with CSRF token,
preventing cross-site forced logout via img tags
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| blueprints | ||
| static | ||
| templates | ||
| __init__.py | ||
| app.py | ||
| auth.py | ||
| ssl_utils.py | ||
| stego_routes.py | ||
| stego_worker.py | ||
| subprocess_stego.py | ||
| temp_storage.py | ||