edruid / proxxi-internet-login-system Goto Github PK

If a view redirects the user agent after messages have been printed; those messages will never reach the user.

suggested solution:

• Move all calls to other controllers/views from a view to its controller.
• In URL::redirect throw an exception if the Message controller has been run.

If the user was redirected from a page because the session was stale, the user should be returned there when logged on.

Also make sure the time is actually used.

The UserGroup form has a backend that checks if current_user may grant a specific group but the frontend still prints all forms enabled.

• What menu items should be active.
• Name of the system
• Mandatory fields
• Static pages

actually check the field "Nuvarande lösenord"...

make sure they don't use the same names though.

Add one time tickets to forms to protect against CSRF.

Ticket should:

• Contain what form it is for (action)
• Contain creation time
• Be saved in the users session

If the ticket is invalid the form should be rendered again with filled fields and a warning message.

currently the user can see the form only if he has the access 'view_access'.

At the strike of midnight the default date for Attendance/create should be the new date

This applies to new users but not imported users.

Might want to wait with this until Proxxi has a new web page.