myron 89c9bfdc49 Security hardening: token-at-rest, rate limiting, XSS, transactions ...

- auth: impersonate stores empty data instead of raw cookie; unimpersonate
  issues a fresh session rather than replaying a stored token
- api/index.php: restore rate limiting (10 req/min auth, 120 general)
- nova.js: 401 redirects to login instead of silently returning error;
  escHtml now escapes single quotes to prevent onclick XSS
- accounts: wrap ownership-change 4-write path in beginTransaction/commit;
  restore audit body on account.update
- reseller/user login cards: use $_pname instead of hardcoded 'NovaCPX'

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-09 07:51:21 +00:00

..

index.php

Security hardening: token-at-rest, rate limiting, XSS, transactions

2026-06-09 07:51:21 +00:00