Carlos Arias
3f69000d27
Two self-contained framework fixes, no schema dependencies: - throttle(): exempt trusted callers via new Functions::isTrustedIp() — loopback, the server's own IP, and an optional TRUSTED_IPS config allowlist (IPs/CIDRs). Fixes the SSG build (which fetches the read API from the box thousands of times per build) tripping the public rate limit and baking empty data into the deploy. Public client IPs stay limited. - public/index.php: set secure session cookie params (httponly, SameSite=Lax, secure on https) before session_start, so session/login state rides on a hardened cookie. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FMQeUnUrAeexcZ7P2Hxa6G |
||
|---|---|---|
| .. | ||
| Components | ||
| Controllers | ||
| Core | ||
| Gateways | ||
| Helpers | ||
| LLM | ||
| Services | ||