4 Commits

Author	SHA1	Message	Date
admin	a6fa3c01d2	v0.333.0 (unreleased): the R-1155 check reads every token source FileBrowser reads, Basic auth included (security review)	2026-10-19 11:43:52 +02:00
admin	c809dd3bc6	v0.333.0: the file manager's own token ends with the dashboard sign-out (R-1155); the recovery-code page says the code becomes live after the check (R-1161)	2026-10-19 11:30:59 +02:00
admin	601bdba253	v0.332.0 (live rc.2 + security review): the pass redirect is absolute; no pass for a cross-site request; no dot-segments in to (R-1100)	2026-10-19 05:03:57 +02:00
admin	9bdd8f8fe8	v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)	2026-10-19 04:56:56 +02:00