02b81f0113
Security (fail-secure for production): - Refuse to start without PPM_PASSWORD/PPM_PASSWORD_HASH unless PPM_ALLOW_NO_AUTH=1 (local dev only) - Add login rate limiting (5 failures / 60s per client), enforced inside SessionManager.login so it cannot be bypassed at the endpoint layer - compose defaults PPM_COOKIE_SECURE=true for HTTPS behind reverse proxy - Add .dockerignore to keep runtime data/out of the image Features: - Task timeline gantt on home page (week/month zoom, horizontal scroll, infinite-arrow for open-ended dates, CSS Grid layout) - Duration metrics gain a second/minute/hour unit for input & display (canonical storage stays integer seconds) - Per-metric progress bars on home page (no more merged average) - Backfill historical records via date picker in the today-record card - Admin panel: stats overview, JSON import/restore, full task list mgmt Fixes: - Nullable task startDate; summarize handles missing start date - Task dialog cancel/close no longer submits the form - Import validates whole backup first, rejects path traversal, rebuilds archives, and replaces stale files Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
12 lines
499 B
Plaintext
12 lines
499 B
Plaintext
# 推荐生产环境使用 PBKDF2 哈希：python -c "from app.auth import make_password_hash; print(make_password_hash('change-me'))"
|
||
PPM_PASSWORD_HASH=
|
||
# 本地快速启动可用明文环境变量，生产环境请改用上面的哈希
|
||
PPM_PASSWORD=change-me
|
||
PPM_PORT=8000
|
||
PPM_COOKIE_SECURE=false
|
||
|
||
# 仅本地开发：允许免密码启动（未设置密码时默认 fail-secure 拒绝启动）
|
||
# 生产环境请勿设置，务必配置 PPM_PASSWORD 或 PPM_PASSWORD_HASH
|
||
PPM_ALLOW_NO_AUTH=false
|
||
|