Matias Griese aa4f80eec1 Greatly improve login related actions for Admin ...

* Better isolate admin to prevent session related vulnerabilities
* Removed support for custom login redirects for improved security
* Shorten forgot password link lifetime from 7 days to 1 hour
* Fixed login related pages being accessible from admin when user has logged in
* Fixed admin user creation and password reset allowing unsafe passwords
* Fixed missing validation when registering the first admin user
* Fixed reset password email not to have session specific token in it

2021-03-26 14:39:37 +02:00

9.0 KiB

Raw Blame History

View Raw