5.3.1

• OTPAuth logs every failed attempt (unknown user, wrong password or wrong OTP code) to the new codenerix.auth.otp logger as OTPAuth failure ip=<address>, with the client address from REMOTE_ADDR and nothing else, so it can be watched by fail2ban. Successful logins, OTP-by-email requests with valid credentials and calls without an authtoken are not logged. The README documents the LOGGING setup and a fail2ban filter and jail.

• file64, static64 and media64 template tags reject paths that resolve outside their base directory (STATIC_ROOT, MEDIA_ROOT or the given basepath) with SuspiciousFileOperation. The check is lexical: symlinks inside the base directory keep working, and a leading / is still relative to the base, as before.