finnandClaude Opus 5.5
2b1160862a
Login: - One message for unknown email, wrong password and deactivated account. Before, "This account is not enabled!" only appeared after the right password and confirmed valid credentials. - Email and password must be non-empty strings. A missing password field became the string "None" and logged in a user with that password. Forms: - "Create user" no longer renders the password back into the HTML after a validation error. - Password fields for a new password use autocomplete="new-password", so a password manager does not fill in the admin's own password. The email fields on the create pages use autocomplete="off". - Email addresses are limited to 64 characters in the local part and 254 in total (RFC 5321). Longer ones caused a database error and HTTP 500. - alerts.html no longer translates flash messages a second time. Running str.format() again on an already formatted message was fragile and logged "Unknown translation" for every German message. All flashes now translate when flashing, "Invalid data" included. Debug mode: - The Docker image sets MAX_PRODUCTION=1, and the app refuses to start in debug mode then. FLASK_DEBUG=1 in production would otherwise enable the fixed secret key, cookies without Secure, no HSTS and query arguments (including password hashes) in the log. - make run-dev and run-dev-as-prod bind to 127.0.0.1. Other: - A denied access is logged with the logger at debug level instead of print. PermissionDenied loses its unused message, it is deliberately answered with a 404. - Fix the typo in /user/<id>/ser-toggle-can-use-different-alias-domain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.stMAX_PRODUCTION=1is set in the Docker image and makes MAX refuse to start in debug mode (FLASK_DEBUG). Do not override it.
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)