Malek TellissiandClaude Sonnet 4.6 4b99ffea15 Fix account-takeover: bind users to nextcloud_id, not email ...

Matching users by email alone allows an attacker with a self-registered
Nextcloud account to hijack any Filament user. Now we look up by
nextcloud_id first; email is only used when creating a brand-new account,
and nextcloud_id is immediately written to the row so future logins
use the stable Nextcloud user ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-09-13 02:54:19 +02:00

..

0001_01_01_000000_create_users_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

0001_01_01_000001_create_cache_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

0001_01_01_000002_create_jobs_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

0001_01_01_192105_packings.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_01_155604_recipes.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_04_162206_create_spices_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_04_165900_create_suppliers_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_09_000849_create_spices_suppliers_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_09_001159_create_products_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_09_001160_products_sizes.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_09_001235_create_product_inventory_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_09_001236_create_product_sales_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_10_15_155741_recipes_spices.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_11_13_101932_create_activity_log_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_11_13_101933_add_event_column_to_activity_log_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2024_11_13_101934_add_batch_uuid_column_to_activity_log_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2026_09_10_000001_create_batches_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2026_09_10_000002_create_batch_origins_table.php

Erster Upload

2026-09-11 01:17:47 +02:00

2026_09_10_000003_shopify_import_adjustments.php

Erster Upload

2026-09-11 01:17:47 +02:00

2026_09_11_000001_shopify_variant_ids.php

Add Shopify inventory sync and order webhook

2026-09-11 02:53:49 +02:00

2026_09_12_031510_add_version_and_product_id_to_recipes.php

Recipe versioning, inline recipe create, recipe summary, Shopify description

2026-09-12 05:18:11 +02:00

2026_09_12_033131_add_production_fields_to_batches.php

Auto-deduct spice inventory when batch is created/updated/deleted

2026-09-12 05:34:09 +02:00

2026_09_12_100000_add_shopify_product_id_to_products.php

Add Shopify publish/sync per product variant

2026-09-12 17:20:26 +02:00

2026_09_12_200000_fix_amount_in_percent_precision.php

Fix 500 on recipe save and surface errors as notifications

2026-09-12 18:19:31 +02:00

2026_09_12_220000_restructure_batch_origins.php

Restructure batch origins: nested entries per ingredient with Supplier/Farmer selects

2026-09-12 20:03:05 +02:00

2026_09_12_230000_add_lot_prefix_to_products.php

Add lot_prefix to products; compose LOT number from prefix + date suffix

2026-09-12 20:35:37 +02:00

2026_09_12_234528_create_permission_tables.php

Roles via Nextcloud groups: sms-admin/manager/viewer + fix OAuth instance_uri

2026-09-13 01:48:24 +02:00

2026_09_12_240000_add_contact_fields_to_suppliers.php

Add address, phone, email, website fields to suppliers

2026-09-12 21:38:53 +02:00

2026_09_12_250000_create_spice_stock_movements.php

Introduce spice_stock_movements ledger for traceable stock changes

2026-09-12 22:34:10 +02:00

2026_09_13_000000_add_piece_weight_to_spices_and_suppliers.php

Add piece_weight calibration: enter Stück + Gramm per delivery, average auto-calculated

2026-09-13 01:26:17 +02:00

2026_09_13_000001_seed_sms_roles.php

Roles via Nextcloud groups: sms-admin/manager/viewer + fix OAuth instance_uri

2026-09-13 01:48:24 +02:00

2026_09_13_100000_add_nextcloud_id_to_users.php

Fix account-takeover: bind users to nextcloud_id, not email

2026-09-13 02:54:19 +02:00