4 Commits

Include renames

Author	SHA1	Message	Date
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
openhands	d782b7c4c2	Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement	2026-07-10 23:34:57 +02:00
openhands	1875a69b83	Fix security scanner findings ... - Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts - Add 'secure' attribute to locale cookie in language-switcher.tsx - Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention) - Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention) - Document intentional MD5 usage for legacy PHP compatibility in password.ts - Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts	2026-07-10 23:08:15 +02:00
Simo	ec2d46e583	Add byte-compatible Auth & SSO core primitives ... Pure, unit-tested primitives the AtomCMS->Next.js login must reproduce exactly (verified now with round-trip + known vectors; full end-to-end check deferred until a real DB + APP_KEY + live emulator are available): - password.ts: argon2id (m=65536,t=4,p=1 via hash-wasm) + bcrypt ($2y$ accepted) verify, and the md5->argon2id on-login upgrade gated by convert_passwords (mirrors RedirectIfTwoFactorAuthenticatable). - sso-ticket.ts: '{hotel_name without spaces}-{uuidv4}' written to auth_ticket + ip_current (mirrors User::ssoTicket()). - laravel-encrypter.ts: AES-256-CBC + HMAC-SHA256 payload compatible with Laravel encrypt()/encryptString (for existing 2FA secrets) incl. PHP string (de)serialization. - totp.ts: otplib Google2FA-compatible TOTP verify (SHA1/6/30). Libs: hash-wasm + bcryptjs + otplib (pure JS/WASM, no native build). 28 tests.	2026-06-27 16:00:25 +02:00