aicctv
d0ba621b42
P4-8: AuthController::login now verifies the CSRF token the login form already emits (Csrf::check over session vs posted field), returning 403 before the user lookup. Closes a login-CSRF / session-fixation hole where a forged cross-site POST could silently log a victim into an attacker's account. Tests seed the session+body token; adds testLoginRejectsMissingOrWrongCsrf. P4-6: ZoneConfigController::save wraps the repository write in try/catch(\RuntimeException) so an ownership/device mismatch is a 400 (invalid_zone) client error, not an uncaught 500. Adds testSaveOwnershipMismatchIs400NotError with a throwing repo double. phpunit: 88 passing (4 skipped: PDO-backed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW |
||
|---|---|---|
| cloud | ||
| deploy | ||
| docs | ||
| edge | ||
| tests | ||
| .gitattributes | ||
| .gitignore | ||
| pyproject.toml | ||