Security audit 2026-10-17, finding A2, stage 0 (the owner, 2026-10-17:
"Выполняй план после аудита"). A stolen global session could set its own
password on the user form and so pass backup-reauth, or add a second global
administrator. The user form gets "Your account password" (autocomplete
current-password) as the last field of box 01, with help that says it is
yours, not the edited user's, and when it is asked: adding a user, changing a
password, an e-mail or a role. Not required in the markup on the edit form -
the server asks only for those changes. The delete page gets the same field,
required, before its buttons. Help's Users topic says all of it. check.py:
0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mixandClaude Opus 5.5
2c27275970