v1.1.21: 6 fixes — _finish_op args, connection leak, pool init, XSS, secure cookie, let

2026-07-29 12:01:00 +04:00
parent 8bc87193d4
commit 515fadbcde
5 changed files with 23 additions and 15 deletions
@@ -91,7 +91,7 @@ def index():
        user_token = request.form.get("token", "")
        active_token = user_token or env_token
        resp = make_response()
-        resp.set_cookie("token", user_token, max_age=60*60*24*365, httponly=True, samesite="Strict")  # 1 год
+        resp.set_cookie("token", user_token, max_age=60*60*24*365, httponly=True, samesite="Strict", secure=True)  # 1 год
        resp.headers["Location"] = "/"   # редирект на GET (убирает POST из истории)
        resp.status_code = 302
        return resp