fleet-management

T

alro65 7fe7304392 Security hardening: IDOR fixes, rate limiting, secret key, session cookies

- IDOR: ownership checks on WO approve/reject/done, charter update/complete/
  send-contracts/request-insurance, captain-contract PDF, insurance-rider PDF,
  delete accounting entry, delete fuel entry, update vessel
- auth.py: rate limiting (10 req/15min), explicit is_active check
- owner.py: role guard on /owner/dashboard
- __init__.py: random SECRET_KEY if unset, absolute SQLite path, parameterized
  SQL (no f-strings), session cookie HTTPONLY+SameSite, 8h session lifetime,
  db.session.get() replacing deprecated query.get()
- api.py: P&L double-count bug fixed (wo_cost was summed twice), Content-
  Disposition filename quoted, APP_BASE_URL env var replaces hardcoded
  localhost:5010, create_management_company validates password length and
  email uniqueness, dead code removed from sync_all_accounting
- create_admin.py: removed password from console output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-05 03:01:49 -04:00

app

Security hardening: IDOR fixes, rate limiting, secret key, session cookies

2026-05-05 03:01:49 -04:00

logs

Add background launcher scripts

2026-05-05 02:34:49 -04:00

.gitignore

Initial commit: Fleet Management app with security hardening and background launcher

2026-05-05 02:54:10 -04:00

add_system_history.py

Initial commit: Fleet Management app with security hardening and background launcher