[serendipity-cvs] [s9y/Serendipity] c2f3d1: Move setting serendipity2faSuccess to login functi...

  Branch: refs/heads/fix/emailHostInjection
  Home:   https://github.com/s9y/Serendipity
  Commit: c2f3d1fb265e296ed681811d87f0905a1cba55b0
      https://github.com/s9y/Serendipity/commit/c2f3d1fb265e296ed681811d87f0905a1cba55b0
  Author: Matthias Gutjahr <[email protected]>
  Date:   2026-03-31 (Tue, 31 Mar 2026)

  Changed paths:
    M include/functions_config.inc.php

  Log Message:
  -----------
  Move setting serendipity2faSuccess to login function (#957)

fixes #956

Signed-off-by: Matthias Gutjahr <[email protected]>


  Commit: 9b6e405892c5d627780a81373c7b968fda754d49
      https://github.com/s9y/Serendipity/commit/9b6e405892c5d627780a81373c7b968fda754d49
  Author: onli <[email protected]>
  Date:   2026-04-08 (Wed, 08 Apr 2026)

  Changed paths:
    M docs/NEWS
    M include/functions_config.inc.php

  Log Message:
  -----------
  Let browser pin down cookie domain (#958)

* Fix attack vector by not using HTTP_HOST for the cookie domain
Instead use the configurable baseURL.

* Do not set a domain manually for the cookie
Then the browser will autoamtically bind the cookie to the origin, which is the safest approach. See https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#domain-and-path-attributes

* Also avoid host in delete cookie function + remove leftover code

* document changes


  Commit: 465c36d7a9fce64be5136994f68513d324bf1200
      https://github.com/s9y/Serendipity/commit/465c36d7a9fce64be5136994f68513d324bf1200
  Author: onli <[email protected]>
  Date:   2026-04-08 (Wed, 08 Apr 2026)

  Changed paths:
    M docs/NEWS
    M include/functions_config.inc.php

  Log Message:
  -----------
  Merge branch 'master' into fix/emailHostInjection


Compare: https://github.com/s9y/Serendipity/compare/1b06f2799bc4...465c36d7a9fc

To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications