Paul LütznerandClaude Opus 5.5 1285e62b7c fix(security): key the 2FA code throttle on the user, not the session ...

The throttle counted per session id, and a fresh password login is a fresh
session, so a stolen password bought unlimited guesses at the code. It now
listens to scheb's ATTEMPT event and keys on the pending token's user
identifier; the reset on success uses the same key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 19:36:59 +02:00

..

Command

fix(snooze): cap the due-snoozed batch by thread, not by joined row

2026-09-23 19:25:12 +02:00

Controller

perf(thread-view): batch the per-message lookups of an open conversation

2026-09-23 19:25:12 +02:00

Documentation

…

Domain

fix(imap): open folders by their path, not their leaf name

2026-09-23 19:28:50 +02:00

e2e

test(e2e): un-fixme the single-target Label-as test

2026-09-23 19:25:12 +02:00

Entity

…

Form

…

Infrastructure

fix(security): publish every Mercure update as private

2026-09-23 19:36:59 +02:00

Jmap

test(jmap): load the lock migration through Doctrine Migrations

2026-09-23 19:12:24 +02:00

Migrations

…

Repository

perf(jmap): Mailbox/get counts only what it will print

2026-09-23 19:12:24 +02:00

Security

fix(security): key the 2FA code throttle on the user, not the session

2026-09-23 19:36:59 +02:00

Service

fix(gmail): a message built for a Gmailify sibling records its carrier

2026-09-23 19:31:08 +02:00

Support

fix(compose): undo, unschedule, discard and attachment POSTs need a token

2026-09-23 19:09:08 +02:00

Twig

…

bootstrap.php

…

phpstan-console-loader.php

…

phpstan-object-manager.php

…