cccms - [no description]

Age	Commit message (Collapse)	Author
2026-07-24	Give all sessions a uniform absolute lifetime of one week	erdgeist
	Enforced at restore via a login-time stamp, written only at genuine logins so the limit stays absolute rather than sliding. The cookie name rotation logs everyone out once at deploy. Second-factor users are deliberately not treated worse than password-only ones.
2026-07-24	Complete the login only after the second factor	erdgeist
	Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery.
2026-07-14	Store return_to before resetting session in loging. Fixes returning to an admin page before logging in	erdgeist

2009-09-06	Marked Controllers private / public and added authorization filters accordingly	hukl

2009-09-03	visual clean up: it all starts with the login screen. this will be so minimal!	hukl

2009-02-21	wiring together some views to make basic navigation	hukl
	in the admin interface possible
2009-02-15	changed layout	hukl

2009-02-15	* regenerated the user fixtures with new site key, login tests work now	simon
	* removed some cookie related tests
2009-02-15	* initial commit of the stripped restful-authentication	simon
	* http basic auth and login from cookie have been removed * no it does not work yet, it's so f*cking secure, it won't even let legitimate users login