Thanakorn 73c680e844 Harden sign-in and password reset ...

- OTP attempt limits, constant-time compare, random reference codes
- DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding
- one generic sign-in failure message; reset request no longer reveals accounts
- no password kept in the session; real status codes on failures

2026-09-24 14:53:40 +07:00

..

change_password.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

company_setting.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

document_types.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

gl_maintenance.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_company.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_profile.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_smtp.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_users.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

request_reset_otp.php

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

reset_password_otp.php

Harden sign-in and password reset

2026-09-24 14:53:40 +07:00

retrieve_company.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

retrieve_profile.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

retrieve_smtp.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

retrieve_users.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

search_users.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

stock_maintenance.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

switch_branch.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

test_smtp.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00