kolaente 3bc0093686 fix: invalidate all sessions when enabling TOTP ...

When a user enables two factor authentication, all existing sessions are
now invalidated, requiring re-authentication. This prevents pre-existing
sessions from bypassing 2FA. The frontend now shows a notice explaining
the logout before the user confirms, and properly logs out after enabling.

Ref: GHSA-pgc7-cmvg-mvp4

2026-03-19 12:27:44 +01:00

..

caldav

fix(caldav): parse timestamps in configured timezone

2026-03-03 12:18:48 +01:00

cmd

fix(cli): make user deletion confirmation check Windows compatible (#2339)

2026-03-05 15:19:08 +01:00

config

refactor: use config.ResolvePath for all rootpath-relative paths

2026-03-09 16:02:05 +01:00

cron

…

db

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

doctor

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

e2etests

test: add e2e tests for user-level webhooks

2026-03-08 19:45:53 +01:00

events

feat: add InitEventsForTesting and Unfake for real event dispatch in tests

2026-03-05 12:49:27 +01:00

files

refactor: use config.ResolvePath for all rootpath-relative paths

2026-03-09 16:02:05 +01:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-03-10 01:08:39 +00:00

initialize

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

log

fix(log): write each log category to its own file (#2206)

2026-02-08 15:22:58 +00:00

mail

fix(mail): disable queue when mailer disabled (#2069)

2026-01-08 15:51:31 +01:00

metrics

…

migration

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

models

fix(tasks): support both expand and expand[] query parameter formats (#2415)

2026-03-19 09:18:11 +00:00

modules

fix: allow browser caching for file downloads (#2349)

2026-03-04 17:43:03 +01:00

notifications

test: add tests for conversational email system

2026-03-08 16:03:47 +01:00

plugins

fix(deps): update module github.com/labstack/echo/v4 to v5 (#2131)

2026-01-24 20:38:32 +01:00

red

…

routes

fix: invalidate all sessions when enabling TOTP

2026-03-19 12:27:44 +01:00

swagger

[skip ci] Updated swagger docs

2026-03-19 09:26:05 +00:00

user

refactor: move ListUsers tests from pkg/user to pkg/models

2026-03-04 20:32:11 +01:00

utils

refactor(utils): extract ContainsPathTraversal to shared utils package

2026-02-25 13:01:00 +01:00

version

…

web

feat(handlers): dispatch pending events after transaction commit

2026-03-03 12:46:34 +01:00

webtests

fix: preserve CalDAV inverse relations when parent has no RELATED-TO (#2389)

2026-03-11 09:40:09 +01:00