picpeak

Files

T

Paul Nothaft 33d6904e66 fix(backend): reject a replayed TOTP code within its validity window (stable) (#1398 )

* fix(backend): reject a replayed TOTP code within its validity window

verifyTotp() was stateless — otplib's window:1 tolerance meant the
same 6-digit code could complete two independent logins inside its
~90s validity window. Track each admin's last-consumed step and
reject a code that doesn't advance past it.

* fix(backend): make the TOTP replay-tracking persist atomic

Backport of the same fix on main: the persist for
two_factor_last_used_step is now a conditional UPDATE (only advances
the step, checked via affected-row count) instead of a plain
unconditional write, closing a TOCTOU race where two concurrent
requests carrying the same captured code could both pass before
either UPDATE landed.

---------

Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>

2026-09-11 11:21:46 +02:00

check-storage.js

feat: add Apple Liquid Glass templates, image security settings, and automated releases

2026-01-03 23:35:23 +01:00

cleanup-thumbnails.js

feat: add Apple Liquid Glass templates, image security settings, and automated releases

2026-01-03 23:35:23 +01:00

create-admin.js

fix: resolve issues #194 , #195 , #196 , #197

2026-02-22 22:27:21 +01:00

generate-openapi.js

feat: public v1 API + token management + OpenAPI docs (#322 )