Skip to content

fix: bind history plugin temp login to an active user session - #6620

Merged
gharlan merged 3 commits into
5.xfrom
fix/history-temp-login-auth-bypass
Aug 3, 2026
Merged

fix: bind history plugin temp login to an active user session#6620
gharlan merged 3 commits into
5.xfrom
fix/history-temp-login-auth-bypass

Conversation

@gharlan

@gharlan gharlan commented Aug 3, 2026

Copy link
Copy Markdown
Member

The temporary login of the history plugin could be used without an active user session. This ties the token to a live session and makes sure the temp session is always cleaned up afterwards.

gharlan added 3 commits August 3, 2026 15:37
The reworked methods are now fully typed and the untyped verifySessionKey()
is gone, so the matching phpstan and psalm baseline entries no longer apply.
@rex-bot rex-bot added the bug label Aug 3, 2026
@gharlan gharlan added Security and removed bug labels Aug 3, 2026
@gharlan gharlan added this to the REDAXO 5.21.4 milestone Aug 3, 2026
@gharlan
gharlan merged commit bcde94a into 5.x Aug 3, 2026
18 checks passed
@gharlan
gharlan deleted the fix/history-temp-login-auth-bypass branch August 3, 2026 13:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants