picpeak

Files

T

Paul Nothaft cdde937d7f fix(backend): reject a replayed TOTP code within its validity window (#1389 )

* fix(backend): reject a replayed TOTP code within its validity window

verifyTotp() was stateless — otplib's window:1 tolerance meant the
same 6-digit code could complete two independent logins inside its
~90s validity window. Track each admin's last-consumed step and
reject a code that doesn't advance past it.

* fix(backend): make the TOTP replay-tracking persist atomic

verifyTotpEncryptedStep() read two_factor_last_used_step, then a plain
UPDATE wrote the new step with no conditional guard — two concurrent
requests carrying the same captured code could both pass the check
before either UPDATE landed. The persist is now a conditional UPDATE
(only advances the step, checked via affected-row count), so a losing
concurrent request is correctly treated as a replay.

---------

Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>

2026-09-11 10:40:27 +02:00

check-storage.js

feat: add Apple Liquid Glass templates, image security settings, and automated releases

2026-01-03 23:35:23 +01:00

cleanup-thumbnails.js

feat: add Apple Liquid Glass templates, image security settings, and automated releases

2026-01-03 23:35:23 +01:00

create-admin.js

fix: resolve issues #194 , #195 , #196 , #197

2026-02-22 22:27:21 +01:00

generate-openapi.js

feat: public v1 API + token management + OpenAPI docs (#322 )