ValuSafe 4.6.1

Security and correctness release. Includes everything from 4.6 (not published separately). Recommended for all installations.

• Sign-in: deleting, downgrading or changing the password of an account now takes effect immediately in sessions that are already signed in. Every sign-in ends after 12 hours at the latest.
• Restore: a database backup is checked before it is restored and only accepted if it contains nothing but what ValuSafe itself writes. Users, SuperAdmin settings and the security log are only restored by the SuperAdmin.
• Two-factor sign-in: backup codes are stored only as hashes and shown once. Existing codes keep working.
• Sign-in cookie with HttpOnly, SameSite and (with HTTPS) Secure on every installation; CSV export guards against formulas in cells; admin-set passwords need at least 8 characters.
• "Own items only" stays restricted if the setting cannot be read; list statistics follow the selected room.
• Deleting an item removes all of its photos from the server.
• Current value: one rule everywhere - the current value if above 0, otherwise the purchase price (dashboard, search bar, insurance, insurance export, damage claim). The dashboard trend compares current value with current value.
• The "Who is online" display has been removed; the IP addresses and pages stored for it are deleted.
• The installed version is shown below "ValuSafe" in the header.

Updating from 4.5.2: copy the new files over the old ones (config.php, upload/, documents/, backups/ stay), delete user_activity.php, then sign in as admin and open migrate.php (migration 015 clears the old "Who is online" data).

Full list: CHANGELOG.md
SHA-256 (ZIP): b8895f6b0bcff8013f44d9de8fe84bd22a5ace6502d0981b85067e0f2eb363da