chore: Version auf 6.2.4 heben

- Dropdown fuer die Merk-Dauer aktiviert jetzt die Checkbox mit; bisher
  wurde die Auswahl ohne gesetzten Haken verworfen und trotzdem nach
  jedem Login ein Code verlangt.
- Abgelaufene oder defekte Trusted-Device-Eintraege fuehrten beim Login
  zu einem NameError (users_data war nicht geladen); Bereinigung neu
  geschrieben.
- Cookie erhaelt das Secure-Flag, wenn die Verbindung HTTPS ist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app.py

@@ -51,7 +51,7 @@ CONFIG_FILE = os.path.join(BASE_DIR, "config.json") # Persistente Konfiguration
 USERS_FILE = os.path.join(BASE_DIR, "users.json")   # User-Datenbank
 HISTORY_FILE = os.path.join(BASE_DIR, "history.json") # Aktivitätsverlauf
 
-APP_VERSION = "6.2.3"
+APP_VERSION = "6.2.4"
 UPLOAD_EXTENSIONS = {".jpg", ".jpeg", ".png", ".mp4"}
 
 app = Flask(__name__)
@@ -731,29 +731,29 @@ def login():
                         trust_token = request.cookies.get("mfa_trust")
                         if trust_token:
                             now = datetime.now()
-                            # Abgelaufene Einträge bereinigen
+                            treffer = None
-                            active = [d for d in user.trusted_devices
+                            aktiv = []
-                                      if d.get("token") != trust_token or
-                                      datetime.fromisoformat(d["expires"]) > now]
-                            changed = len(active) != len(user.trusted_devices)
                             for d in user.trusted_devices:
+                                try:
+                                    expires = datetime.fromisoformat(d["expires"])
+                                except (ValueError, KeyError, TypeError):
+                                    continue  # kaputter Eintrag fliegt raus
+                                if expires <= now:
+                                    continue  # abgelaufener Eintrag fliegt raus
+                                aktiv.append(d)
                                 if d.get("token") == trust_token:
-                                    try:
+                                    treffer = d
-                                        expires = datetime.fromisoformat(d["expires"])
+                            if len(aktiv) != len(user.trusted_devices):
-                                        if expires > now:
+                                users_data = load_users()
-                                            # Trusted Device gültig → MFA überspringen
+                                users_data.setdefault(email, {})["trusted_devices"] = aktiv
-                                            login_user(user)
-                                            add_history_entry("user_login", f"User '{email}' angemeldet (Trusted Device)", email)
-                                            if user.must_change_password:
-                                                return redirect("/change-password")
-                                            return redirect("/admin")
-                                        else:
-                                            pass
-                                    except (ValueError, KeyError):
-                                        pass
-                            if changed:
-                                users_data[email]["trusted_devices"] = active
                                 save_users(users_data)
+                            if treffer:
+                                # Trusted Device gültig → MFA überspringen
+                                login_user(user)
+                                add_history_entry("user_login", f"User '{email}' angemeldet (Trusted Device)", email)
+                                if user.must_change_password:
+                                    return redirect("/change-password")
+                                return redirect("/admin")
                         session["mfa_user"] = email
                         session["mfa_password_ok"] = True
                         return redirect("/mfa/verify")
@@ -828,7 +828,7 @@ def mfa_verify():
                         resp.set_cookie("mfa_trust", token, max_age=days * 86400,
                                         path="/",
                                         httponly=True, samesite="Lax",
-                                        secure=False)
+                                        secure=request.is_secure)
                         return resp
                 except (ValueError, TypeError):
                     pass

history.json

@@ -1,4 +1,304 @@
 [
+  {
+    "timestamp": "2026-09-07 10:45:56",
+    "action": "user_login",
+    "detail": "User 't@x.de' angemeldet (Trusted Device)",
+    "user": "t@x.de"
+  },
+  {
+    "timestamp": "2026-09-07 10:45:56",
+    "action": "user_login",
+    "detail": "User 't@x.de' angemeldet (mit MFA, Ger\u00e4t f\u00fcr 7 Tage gespeichert)",
+    "user": "t@x.de"
+  },
+  {
+    "timestamp": "2026-09-07 10:44:24",
+    "action": "user_login",
+    "detail": "User 't@x.de' angemeldet (Trusted Device)",
+    "user": "t@x.de"
+  },
+  {
+    "timestamp": "2026-09-07 10:44:24",
+    "action": "user_login",
+    "detail": "User 't@x.de' angemeldet (mit MFA, Ger\u00e4t f\u00fcr 7 Tage gespeichert)",
+    "user": "t@x.de"
+  },
+  {
+    "timestamp": "2026-09-04 10:38:34",
+    "action": "user_login",
+    "detail": "User 'erik.thiele@cancom.de' angemeldet",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:58:05",
+    "action": "screen_deleted",
+    "detail": "Screen 'xxx' an Standort 'test' gel\u00f6scht",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:57:39",
+    "action": "screen_created",
+    "detail": "Screen 'xxx' an Standort 'test' angelegt",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:56:56",
+    "action": "background_uploaded",
+    "detail": "Hintergrundbild f\u00fcr Standort 'test' hochgeladen",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:53:02",
+    "action": "customer_added",
+    "detail": "Kunden (WIN, IBM, Gaufer) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: casino, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:44:39",
+    "action": "screen_created",
+    "detail": "Screen 'casino' an Standort 'test' angelegt",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:44:31",
+    "action": "site_deleted",
+    "detail": "Standort 'casino' gel\u00f6scht",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:44:25",
+    "action": "site_created",
+    "detail": "Standort 'casino' angelegt",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:41:44",
+    "action": "customer_added",
+    "detail": "Kunden (WIN, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:41:32",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 17:40:55",
+    "action": "customer_added",
+    "detail": "Kunden (XXTT) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 16:10:33",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:59:00",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:52:39",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:52:13",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:52:04",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:42:42",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:42:25",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:36:52",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "admin"
+  },
+  {
+    "timestamp": "2026-09-02 15:32:23",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:32:06",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:31:59",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:31:44",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:31:31",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:31:14",
+    "action": "customer_added",
+    "detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:30:36",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:28:22",
+    "action": "customer_added",
+    "detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "admin"
+  },
+  {
+    "timestamp": "2026-09-02 15:26:50",
+    "action": "customer_added",
+    "detail": "Kunden (HellesLogo) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "admin"
+  },
+  {
+    "timestamp": "2026-09-02 15:23:36",
+    "action": "customer_added",
+    "detail": "Kunden (UploadTest) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "admin"
+  },
+  {
+    "timestamp": "2026-09-02 15:22:22",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:21:07",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:19:35",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:19:21",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:09:15",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:08:35",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:08:14",
+    "action": "customer_added",
+    "detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:07:50",
+    "action": "customer_added",
+    "detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:02:34",
+    "action": "customer_added",
+    "detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:02:01",
+    "action": "customer_added",
+    "detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 15:01:07",
+    "action": "customer_added",
+    "detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 14:35:54",
+    "action": "customer_added",
+    "detail": "Kunden (Testkunde) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
+    "user": "admin"
+  },
+  {
+    "timestamp": "2026-09-02 14:31:04",
+    "action": "screen_created",
+    "detail": "Screen 'vorstand' an Standort 'test' angelegt",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 14:30:58",
+    "action": "site_created",
+    "detail": "Standort 'test' angelegt",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 14:30:51",
+    "action": "user_login",
+    "detail": "User 'erik.thiele@cancom.de' angemeldet",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 14:29:42",
+    "action": "password_changed",
+    "detail": "Passwort f\u00fcr User 'erik.thiele@cancom.de' ge\u00e4ndert",
+    "user": "erik.thiele@cancom.de"
+  },
+  {
+    "timestamp": "2026-09-02 14:29:34",
+    "action": "user_login",
+    "detail": "User 'erik.thiele@cancom.de' angemeldet (Passwort-\u00c4nderung erforderlich)",
+    "user": "erik.thiele@cancom.de"
+  },
   {
     "timestamp": "2026-08-29 16:20:09",
     "action": "user_login",

templates/mfa_verify.html

@@ -46,7 +46,7 @@
                 <input class="form-check-input" type="checkbox" id="remember" name="remember" value="7">
                 <label class="form-check-label" for="remember">
                   Gerät für
-                  <select class="form-select form-select-sm d-inline-block w-auto" id="remember_days" onchange="document.getElementById('remember').value=this.value">
+                  <select class="form-select form-select-sm d-inline-block w-auto" id="remember_days">
                     <option value="1">1 Tag</option>
                     <option value="3">3 Tage</option>
                     <option value="7" selected>7 Tage</option>
@@ -61,10 +61,13 @@
                   var cb = document.getElementById('remember');
                   var sel = document.getElementById('remember_days');
                   cb.addEventListener('change', function() {
-                    if (this.checked) this.value = sel.value;
+                    this.value = sel.value;
                   });
+                  // Wer im Dropdown eine Dauer waehlt, will das Geraet merken:
+                  // Checkbox automatisch mit aktivieren.
                   sel.addEventListener('change', function() {
-                    if (cb.checked) cb.value = this.value;
+                    cb.checked = true;
+                    cb.value = this.value;
                   });
                 })();
               </script>

users.json

@@ -19,7 +19,6 @@
     "trusted_devices": []
   },
   "erik.thiele@cancom.de": {
-    "password_hash": "scrypt:32768:8:1$D8XYprsEYMO5EPrG$2829b18f77bbd7d9f0cbb945b0bdbc32e16d7889f8711881f82dd35accd26ddb7c31d3fa85e3b89d19d6d1f0b92d8d18765e1c82044188cab8fd0db2d35a0d15",
     "role": "admin",
     "sites": [],
     "must_change_password": false,
@@ -27,24 +26,13 @@
     "last_name": "Thiele",
     "department": "CSO",
     "notes": "Standort Stuttgart",
-    "mfa_secret": "LR5DYI3SQPMW5XWKO33HPETHY5TPOWRG",
-    "mfa_enabled": true,
-    "mfa_recovery_codes": [
-      "7BBD93",
-      "EB1D3B",
-      "BEE291",
-      "D471D5",
-      "D43C00",
-      "75DBAC",
-      "8B00CB",
-      "7AF72D"
-    ],
     "trusted_devices": [
       {
         "token": "5kMgj4JPxd2IHuzV5MagAAcYyi_DBImyGimBSvZUNVg",
         "expires": "2026-07-24T15:40:28.955130"
       }
-    ]
+    ],
+    "password_hash": "scrypt:32768:8:1$9k9WAwHOnYTdKY4Q$869e9bec6a838c212543a228edc7a516933b37b9494bb1d10424f18adef3ea132d4c340ab939ca023c22ab0d4def13ad64c44a648f64ce519c2097adc0537f92"
   },
   "test1@test.de": {
     "password_hash": "scrypt:32768:8:1$35kBhL79TJyVA3Rz$98b2e269db5ae96c9285323a274a0cc5b199fb45078e7530b5e72cdb9b96d5b522aa18fd06ce0f801bd19ec68ed323ffa04ce484cfb849eba73b9260ca6a50e1",