mixandClaude Opus 5.5
2c27275970
Security audit 2026-10-17, finding A2, stage 0 (the owner, 2026-10-17: "Выполняй план после аудита"). A stolen global session could set its own password on the user form and so pass backup-reauth, or add a second global administrator. The user form gets "Your account password" (autocomplete current-password) as the last field of box 01, with help that says it is yours, not the edited user's, and when it is asked: adding a user, changing a password, an e-mail or a role. Not required in the markup on the edit form - the server asks only for those changes. The delete page gets the same field, required, before its buttons. Help's Users topic says all of it. check.py: 0 violations; outlines unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.8 KiB
HTML
32 lines
1.8 KiB
HTML
<!-- title: Delete acme-ops | section: server | page: users -->
|
|
<div class="sp-head">
|
|
<div class="sp-grow">
|
|
<p class="sp-kicker"><a href="users.html">Users</a> / <a href="user.html">acme-ops</a> /</p>
|
|
<h1 class="title is-3">Delete acme-ops</h1>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="columns">
|
|
<div class="column is-7">
|
|
<div class="box sp-danger-zone">
|
|
<div class="sp-box-head"><span class="sp-no"><i class="ti ti-alert-triangle"></i></span><h2>This cannot be undone</h2></div>
|
|
<div class="sp-box-body">
|
|
<p class="mb-3">Deleting the panel user <strong>acme-ops</strong> will:</p>
|
|
<ul class="sp-list-check">
|
|
<li><i class="ti ti-x"></i>end any signed-in session of this user at once;</li>
|
|
<li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> (outbound) and to <strong>acme.io</strong> (inbound).</li>
|
|
</ul>
|
|
<p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
|
|
<form method="post" action="users.html">
|
|
<div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
|
|
<p class="help">The one you sign in with: a session left open must not be enough to remove an administrator.</p></div>
|
|
<div class="buttons">
|
|
<button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>
|
|
<a class="button is-text" href="user.html">Keep it</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|