Whykioh 42a388cbe1 Harden for public launch: rate limiting, CORS, error display, Gitea webhook sig ...

- User::login() locks an account for 15 min after 5 failed attempts
- CORS now restricted to an explicit origin whitelist instead of *
- display_errors disabled in production (errors still logged server-side)
- webhook.php now checks Gitea's actual signature header (X-Gitea-Signature,
  raw hex) instead of GitHub's format, which never matched on this Gitea instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-12 17:53:28 +02:00

..

Movie.php

aze

2026-07-12 16:27:06 +02:00

User.php

Harden for public launch: rate limiting, CORS, error display, Gitea webhook sig

2026-07-12 17:53:28 +02:00