c2f2429

fix(security): address 19 audit findings — H-1 (MCP FinancialFieldPolicy), M-1..M-9 (CSP/XSS/2FA/files/worklog/throttling/impersonation), L-1..L-12 (HTML/CSS/SSRF/ratelimit/password/cookie/fingerprint)

2026-08-23T18:32:47+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files78

Core0

Module0

Forbidden0

Files

api/controller/auth/AuthController.php (api)
api/controller/health/HealthController.php (api)
api/controller/idea/IdeaController.php (api)
api/controller/mcp/McpController.php (api)
api/model/security/TwoFactorRepository.php (api)
api/model/worklog/WorklogRepository.php (api)
api/system/library/database/SchemaManager.php (api)
api/system/library/database/migration/FileVisibilityMigration.php (migration)
api/system/library/database/migration/MigrationManager.php (migration)
api/system/library/database/migration/TwoFactorHardeningMigration.php (migration)
api/system/library/security/FinancialFieldPolicy.php (api)
api/system/library/security/HtmlSanitizer.php (api)
api/system/library/service/AuthService.php (api)
api/system/library/service/ExternalUserService.php (api)
api/system/library/service/FileService.php (api)
api/system/library/service/ImpersonationService.php (api)
api/system/library/service/InvitationService.php (api)
api/system/library/service/RateLimitService.php (api)
api/system/library/service/TaskService.php (api)
api/system/library/service/TwoFactorService.php (api)
web/index.php (web)
web/view/template/page/admin_knowledge.php (web)
web/view/template/page/admin_module_detail.php (web)
web/view/template/page/admin_modules.php (web)
web/view/template/page/admin_modules_install.php (web)
web/view/template/page/admin_updates.php (web)
web/view/template/page/chat.php (web)
web/view/template/page/client_detail.php (web)
web/view/template/page/contacts.php (web)
web/view/template/page/counterparty_detail.php (web)
web/view/template/page/departments.php (web)
web/view/template/page/external_accept.php (web)
web/view/template/page/ideas.php (web)
web/view/template/page/knowledge.php (web)
web/view/template/page/knowledge_page.php (web)
web/view/template/page/profile.php (web)
web/view/template/page/project_detail.php (web)
web/view/template/page/task_detail.php (web)
web/view/template/page/teams.php (web)
api/controller/auth/AuthController.php (api)
api/controller/health/HealthController.php (api)
api/controller/idea/IdeaController.php (api)
api/controller/mcp/McpController.php (api)
api/model/security/TwoFactorRepository.php (api)
api/model/worklog/WorklogRepository.php (api)
api/system/library/database/SchemaManager.php (api)
api/system/library/database/migration/FileVisibilityMigration.php (migration)
api/system/library/database/migration/MigrationManager.php (migration)
api/system/library/database/migration/TwoFactorHardeningMigration.php (migration)
api/system/library/security/FinancialFieldPolicy.php (api)
api/system/library/security/HtmlSanitizer.php (api)
api/system/library/service/AuthService.php (api)
api/system/library/service/ExternalUserService.php (api)
api/system/library/service/FileService.php (api)
api/system/library/service/ImpersonationService.php (api)
api/system/library/service/InvitationService.php (api)
api/system/library/service/RateLimitService.php (api)
api/system/library/service/TaskService.php (api)
api/system/library/service/TwoFactorService.php (api)
web/index.php (web)
web/view/template/page/admin_knowledge.php (web)
web/view/template/page/admin_module_detail.php (web)
web/view/template/page/admin_modules.php (web)
web/view/template/page/admin_modules_install.php (web)
web/view/template/page/admin_updates.php (web)
web/view/template/page/chat.php (web)
web/view/template/page/client_detail.php (web)
web/view/template/page/contacts.php (web)
web/view/template/page/counterparty_detail.php (web)
web/view/template/page/departments.php (web)
web/view/template/page/external_accept.php (web)
web/view/template/page/ideas.php (web)
web/view/template/page/knowledge.php (web)
web/view/template/page/knowledge_page.php (web)
web/view/template/page/profile.php (web)
web/view/template/page/project_detail.php (web)
web/view/template/page/task_detail.php (web)
web/view/template/page/teams.php (web)