v2.3.0

What's new

v2.3.0 is a security-hardening and correctness pass across the local dashboard, the booking automation, and the Windows QR-login flow, plus a few smaller UX fixes.

Security fixes

• CSRF: every state-changing endpoint (setup, reset account, pause, relogin, quit, ...) now requires a matching Host/Origin and JSON content type, closing a gap where any web page open in the same browser could silently POST to the local dashboard.
• Stored XSS: the notification-topic field was interpolated unescaped into the Settings page; it's now delivered the same safe way every other field already was.
• DNS rebinding: /settings and /status.json now validate the request's Host header too, not just the GET-vs-POST split.
• Session cookie leak: the info-kierowca.pl session cookie could be forwarded across an HTTP redirect to a different origin; redirects now strip credential headers whenever the target origin differs.
• Assorted hardening: PZ login credential-typing TOCTOU window closed, host-suffix matching fixed against a look-alike-domain edge case, tools/diagnose.py's page-capture now redacts PKK/PESEL/OTP-shaped text instead of a since-broken code path silently skipping the redaction it claimed to do, and every state file/log/directory this app writes is now consistently locked to owner-only permissions.

Booking automation correctness (auto_select_slot / auto_confirm_reschedule)

These flags are still off by default and still experimental, but several real correctness bugs in the matching/confirmation logic are fixed:

• Slot matching is now scoped to both the correct exam centre and the correct date — previously a same-time/type slot at the wrong centre or wrong date group could be selected.
• The pre-confirm summary check is now scoped to the actual modal instead of the whole page behind it.
• The final confirm click can no longer double-submit on a slow/lost network response.
• A single transient error no longer permanently disables post-booking verification.
• Accounts with more than one active booking (e.g. theory + practical) can now verify a successful reschedule correctly.

Not yet re-verified against the live site — the DOM-dependent parts of this pass (row/date-group scoping, the modal selector, the new centre-match rule) are logic-verified and covered by 50+ new tests, but watch the first live auto_confirm_reschedule run closely before trusting it unattended. The new centre-match rule fails closed (refuses rather than guesses) if it can't confirm a match.

Windows QR-login

Re-diagnosed a reported stall where Chrome opened the login page but never clicked through. The initial --lang=pl-PL fix turned out not to be the cause; this release adds real diagnostics (viewport size, DPI, registration acknowledgement) instead of guessing again, and separately fixes a confirmed bug where backing out of the login flow past an origin boundary could re-trigger auto-clicking forward against the user's own navigation.

Other

• PKK number/license category now prefill on the Settings page too (previously only on first run), with a read-only masked display for a single profile and a partially-masked picker for multiple.
• Session-expiry countdown is hidden for Profil Zaufany accounts, since that session renews itself proactively; the manual "get new session" action moved into Settings.
• Added a favicon.

Validation

• 350 automated tests passed locally, with 3 OpenSSL-dependent tests skipped.
• CI passed on Python 3.9, 3.11, and 3.13, including the installed-wheel smoke test.
• PyInstaller builds, packaged TLS policy checks, verified HTTPS smoke tests, and packaged keyring discovery smoke tests passed on Windows, macOS, and Linux.