Graham McIntire
3632580d1b
- Client IP: only trust X-Forwarded-For from RFC 1918 proxy IPs - Webhook auth: handle nil/blank secret with controlled error, not 500 crash - Sudo redirect: reuse validated return_path? from login to prevent open redirect - Map live: remove redundant inline script (ensureLeaflet hook handles loading) - Bang calls: convert crash-prone exact matches to case in QR live and API controllers |
||
|---|---|---|
| .. | ||
| api_auth.ex | ||
| brute_force_protection.ex | ||
| capture_timezone.ex | ||
| check_policy_consent.ex | ||
| detect_eu_user.ex | ||
| filter_noisy_logs.ex | ||
| graphql_auth.ex | ||
| graphql_introspection.ex | ||
| markdown_negotiation.ex | ||
| mobile_auth.ex | ||
| rate_limit.ex | ||
| remote_ip_logger.ex | ||
| security_headers.ex | ||
| update_session_activity.ex | ||
| webhook_auth.ex | ||