v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00
parent 00a0d91976
commit f75b3aa778
212 changed files with 2414 additions and 398 deletions
@@ -74,6 +74,8 @@ ALLOWLIST = {
    ".CSRFField": "CSRF token — same",
    ".FormToken": "the family sign-in form's own CSRF (an HMAC over its expiry, v0.287.0) — the visitor has no "
                  "session; it opens nothing, it only proves the POST came from the page",
+    ".LogoutToken": "the family sign-out form's CSRF (an HMAC naming the family session, R-983 v0.324.0) — useless "
+                    "without that session's cookie; it opens nothing, it only proves the sign-out came from the page",
 }