Pontoporeia 04094d802d fix: harden security based on pentest scan findings ...

- Add Content-Security-Policy to main nginx server block (was only on /admin/)
- Add Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers
- Add includeSubDomains to HSTS header
- Set HttpOnly, Secure, SameSite=Lax session cookie params on public pages
  (AdminAuth already hardens the /admin session with SameSite=Strict)
- Update xamxam.conf.reference and SECURITY_HEADERS.md to match

2026-05-19 00:08:06 +02:00

..

admin

fix: harden security based on pentest scan findings

2026-05-19 00:08:06 +02:00

partials

feat: refactor licence fragment — Libre→CC2r+licence, Interne→opt-in want_license, Interdit→none, add details/summary to license UI

2026-05-19 00:08:06 +02:00

public

feat: upload progress bar — fieldset layout, accent colors, file name display, completion animation, 800ms redirect delay; decorelate formats from fichiers; server-side poll via token; bump PeerTube embed audio player

2026-05-19 00:08:06 +02:00

footer.php

some css changes

2026-04-24 23:01:25 +02:00

head.php

feat: add file display to forms and recap pages

2026-04-27 20:52:27 +02:00

header.php

Admin mobile block: fix inline style beating media query

2026-05-19 00:08:05 +02:00