xamxam

PostERG/xamxam

0 Fork 0

mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-11-09 19:20:09 +01:00

Commit Graph

Author	SHA1	Message	Date
Pontoporeia	d588ae004d	Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())	2026-06-15 15:56:52 +02:00
Pontoporeia	04094d802d	fix: harden security based on pentest scan findings - Add Content-Security-Policy to main nginx server block (was only on /admin/) - Add Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers - Add includeSubDomains to HSTS header - Set HttpOnly, Secure, SameSite=Lax session cookie params on public pages (AdminAuth already hardens the /admin session with SameSite=Strict) - Update xamxam.conf.reference and SECURITY_HEADERS.md to match	2026-05-19 00:08:06 +02:00
Pontoporeia	c949cf9481	rename posterg → xamxam throughout: nginx conf, scripts, PHP source, docs	2026-05-05 11:04:52 +02:00

Author

SHA1

Message

Date

Pontoporeia

d588ae004d

Reintroduce TFE duration metadata: DB columns, form fields, controllers, views, and migration

Add 'unsafe-eval' to CSP script-src directives (htmx requires Function())

2026-06-15 15:56:52 +02:00

Pontoporeia

04094d802d

fix: harden security based on pentest scan findings

- Add Content-Security-Policy to main nginx server block (was only on /admin/)
- Add Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers
- Add includeSubDomains to HSTS header
- Set HttpOnly, Secure, SameSite=Lax session cookie params on public pages
  (AdminAuth already hardens the /admin session with SameSite=Strict)
- Update xamxam.conf.reference and SECURITY_HEADERS.md to match

2026-05-19 00:08:06 +02:00

Pontoporeia

c949cf9481

rename posterg → xamxam throughout: nginx conf, scripts, PHP source, docs

2026-05-05 11:04:52 +02:00