petrbalvin 52be2bb996 security: CORS preflight, session invalidation, CSRF on preview, symlink containment, and hardening ...

- Add OPTIONS /api/volumen/* for CORS preflight (S-22).
- Invalidate session in require_login! when user no longer exists (S-8).
- Add check_csrf! to POST /admin/preview (S-1).
- Use File.realpath for symlink-safe containment in media_file (S-2).
- Memoize Users#all with mtime-based invalidation (S-12).
- Document that empty permitted_hosts means allow-all (S-5).
- Warn and fall back to random when session_key is too short (S-20).

2026-06-25 22:06:49 +02:00

..

volumen

security: CORS preflight, session invalidation, CSRF on preview, symlink containment, and hardening

2026-06-25 22:06:49 +02:00

volumen.rb

fix: add periodic cleanup of login_attempts hash

2026-06-25 21:40:37 +02:00