Thanakorn 73c680e844 Harden sign-in and password reset ...

- OTP attempt limits, constant-time compare, random reference codes
- DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding
- one generic sign-in failure message; reset request no longer reveals accounts
- no password kept in the session; real status codes on failures

2026-09-24 14:53:40 +07:00

..

ac_dashboard

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

accounting

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

assets

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

contact

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

cron

Fix QA review findings: server-side validation, notes encoding, dashboard totals

2026-09-19 10:58:42 +07:00

dashboard

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

expense

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

finance

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

ics

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

inventory

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

journal

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

login

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

order

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

po

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

reports

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

revenue

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

setting

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

config.example.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

dbconn.php

Fix QA review findings: server-side validation, notes encoding, dashboard totals

2026-09-19 10:58:42 +07:00

file.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_ending.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_header.php

Fix timestamps, delete requests, invoice dates and GR quantities

2026-09-17 09:00:15 +07:00

include_master_sidebar.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_setting_sidebar.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

include_sidebar_ac.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_sidebar.php

Seed Demo Data - Rebranding

2026-08-17 13:12:07 +07:00

include_topbar.php

Harden web root, secrets and realtime auth

2026-09-24 14:53:40 +07:00

index.php

init wms

2026-02-19 14:48:40 +07:00

preset.php

JSON output

2026-05-13 16:41:28 +07:00

session.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00