Malek TellissiandClaude Sonnet 4.6 4b99ffea15 Fix account-takeover: bind users to nextcloud_id, not email ...

Matching users by email alone allows an attacker with a self-registered
Nextcloud account to hijack any Filament user. Now we look up by
nextcloud_id first; email is only used when creating a brand-new account,
and nextcloud_id is immediately written to the row so future logins
use the stable Nextcloud user ID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-09-13 02:54:19 +02:00

..

Api

Update LOT API to use nested batch_origin_entries structure

2026-09-12 20:07:53 +02:00

Controller.php

Erster Upload

2026-09-11 01:17:47 +02:00

OAuthController.php

Fix account-takeover: bind users to nextcloud_id, not email

2026-09-13 02:54:19 +02:00

ShopifyWebhookController.php

Add Shopify inventory sync and order webhook

2026-09-11 02:53:49 +02:00