finn/max

0 Fork 0

T

finnandClaude Opus 5.5 58242117f6 Ask for the current password when changing the own password

A hijacked session was enough to change the own password, lock out the
owner and get permanent access, including the mailbox via Dovecot.

Changing the own password now requires the current password, for users
and admins alike. Admins changing the password of another user are not
asked, since an admin session can take over accounts in other ways
anyway. The new password fields are marked as new-password for password
managers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-21 19:38:14 +00:00

.devcontainer

Add the Python extension and interpreter path to the devcontainer

2026-10-21 19:24:37 +00:00

.vscode/.ropeproject

initial commit

2020-04-13 08:31:44 +02:00

csrf-test

Use port 8757 for the dev server

2026-10-21 08:39:28 +00:00

max

Ask for the current password when changing the own password

2026-10-21 19:38:14 +00:00

scripts

Remove old docker-compose based dev setup

2026-10-21 08:39:28 +00:00

.dockerignore

Harden the container: non-root, no build tools, read-only, stdout logging

2026-10-21 18:09:30 +00:00

.gitignore

Harden the container: non-root, no build tools, read-only, stdout logging

2026-10-21 18:09:30 +00:00

docker-compose.yml

Harden the container: non-root, no build tools, read-only, stdout logging

2026-10-21 18:09:30 +00:00

Dockerfile

Harden the container: non-root, no build tools, read-only, stdout logging

2026-10-21 18:09:30 +00:00

LICENCE

initial commit

2020-04-13 08:31:44 +02:00

Makefile

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

README.md

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

requirements-dev.in

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

requirements-dev.txt

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

requirements.in

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

requirements.txt

Pin all dependencies with hashes and add a CVE audit

2026-10-21 18:30:08 +00:00

setup.cfg

Make isort compatible with black

2026-10-21 09:06:51 +00:00

VERSION

modernizing the dependencies

2026-10-19 18:53:59 +02:00

workspace.code-workspace

initial commit

2020-04-13 08:31:44 +02:00

README.md

MAX

A small little program to manage emails.

The proxy should add X-Real-IP to get a better logging.

Setup

Requirements: Docker, Make

Start with make run-dev

Configuration

MAX_ORIGIN (required in production): The public origin of MAX, e.g. https://max.finn.st

Dependencies

Direct dependencies are listed in requirements.in (production) and requirements-dev.in (development tools). requirements.txt and requirements-dev.txt are lockfiles with exact versions and hashes

After changing a .in file: make lock-deps and make sync-deps
Update all dependencies: make update-deps and make sync-deps
Check for known vulnerabilities: make audit (before every release)