Security advisory 2 addressed

2026-08-26 15:35:10 +02:00
parent fec7836384
commit 0287305884
11 changed files with 32 additions and 24 deletions
@@ -154,6 +154,7 @@
 145. For the new password in the user setting add a validation field to make sure they are the same before submitting
 146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
 147. Make sure the web plugin follows same logic
+154. Implement the recommendation for ### SA-002: Bearer tokens accepted in query strings
 146. Change so that authentication is based on email address rather than username - maintain the username for presentation purposes
 147. Make sure the web plugin follows same logic
 148. In the plugin <span data-i18n="emailLabel">emailLabel</span> should read: <span data-i18n="emailLabel">Email</span>
@@ -162,6 +163,7 @@
 151. Choose primary email from already verified alternative email addresses and increase the number of alternative email addresses allowed to 5.
 152. Make sure an email can only be selected when it has been validated.
 153. Remove the entire "New primary email address" block; keep only selecting an existing alternative as primary.
+155. Remove the “New primary email address” functionality and keep only selecting an existing alternative as primary.

 ## Future entries