Password-Manager

Files

T

r-zakarya c2cc9c72e6 fix(session): write expires_at in UTC, not local time (audit 6c-2)

CreateSession wrote FormatDateTime(IncHour(Now,24)) = local, but RequireCSRF
and CleanupExpired compare against SQLite datetime('now') = UTC. On negative
UTC offsets the CSRF window fell short of the 24h auth window: between the two,
GETs authed fine but every write got 403 "Invalid CSRF token". Now
IncHour(NowUTC,24) on write + LExpires < NowUTC in Authenticate, so all three
readers are UTC-consistent. Last FormatDateTime(...,Now) in the backend —
closes §2.2 for real. NowUTC + DateUtils already in uses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-20 05:25:37 +01:00

assets

refactor(js): extract attachments, autofill, unlock modules from app.js (3.1)

2026-07-11 19:28:19 +01:00

Handlers

fix(sync): preserve created_at/updated_at when sync adds a remote entry

2026-07-13 00:18:13 +01:00

Source

fix(session): write expires_at in UTC, not local time (audit 6c-2)

2026-07-20 05:25:37 +01:00

app.ico

feat: MFA tools, single-instance, tray polish, prefs persistence