Nicola Murino 98f7e467ab dataprovider: refuse self-service writes made from a stale snapshot ...

A user or admin changing its own password, profile or two-factor
settings wrote the whole account back and could overwrite a concurrent
administrator change. Self-service updates are now conditional on the
stored updated_at matching the value read, and every update stores a
strictly increasing updated_at.

Thanks to Thomas Toth for the report.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>

2026-09-07 21:07:59 +02:00

..

swagger-ui

update js and css deps

2026-05-30 19:31:04 +02:00

httpfs.yaml

back to development

2023-07-15 12:35:30 +02:00

openapi.yaml

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00