v1.3.3

This release also includes everything from v1.3.2, which wasn't published on its own.

Security

• Cross-origin isolation headers (1.3.3). Every page now also sends Cross-Origin-Embedder-Policy: require-corp, Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin, alongside the existing Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• Setup code limits (1.3.2, extended in 1.3.3). On a new install, wrong setup codes are limited to 10 per address in 15 minutes (1.3.2), and to 40 from all addresses together (1.3.3), so guessing from many addresses or a faked X-Forwarded-For is still stopped. A paused address is told nothing more than "that setup code isn't right"; the error log says it's paused. Attempts made while paused aren't counted, so a pause can't be extended indefinitely. To clear a lockout: DELETE FROM login_attempts WHERE username = 'setup';

Sharing: migraine and headache medicines (1.3.2)

• Headache diary medicines follow the Medicines permission. Someone you share with who doesn't have Medicines access sees no medicines at all in the diary, including names you typed in rather than chose from Meds.
• Medicine counts follow it too. For them, painkiller and triptan days on the Migraine page, the month-by-month table and the clinician summary show "not shared" ("–"), and no medication overuse warnings are shown.
• Private medicines are never shown to anyone you share with. That covers diary entries, medicine-day counts and as-needed doses logged on Today, whatever their Medicines access. Headache and migraine days are part of Care, so they still show for anyone with Care access.
• A regression test checks this for the owner, someone with Medicines shared, and someone without: php tests/sharing_medicines_test.php (run it against a test database).

Privacy policy (1.3.3)

• The generated privacy policy now mentions the second cookie set by Remember this device, and the list of signed-in devices (with their IP addresses) under Active sessions.

Documentation

• Behind a proxy (1.3.2): the README and config.example.php now explain 'trust_proxy' => true. Set it behind a reverse proxy or load balancer you control, so sign-in and setup limits apply to each visitor's own address. The README also explains how to clear a setup code lockout.
• README and in-app help (1.3.3): brought up to date with everything since v1.2.5. That covers allergies, private health care, migraine weather, self-check routines, cycle-based schedules, minimum time between doses, two-factor sign-in, remembered devices, password reset, active sessions, the Report tab, and the full list of settings.
• A new Travel section (1.3.3) in the Medicines help.
• 28 new screenshots (1.3.3) from the demo account, across Private health care, Care, Medicines, Mind, Migraine, History, Readings, Appointments and Account.
• config.example.php (1.3.3) now shows the weather, setup_code and push.allowed_hosts settings.

Upgrading

Install from Admin → Version, or git pull. No database changes are needed. If Pillbox sits behind a reverse proxy or Cloudflare, set 'trust_proxy' => true in config/config.php.