Update: admin panel, SMTP/EWS/Outlook mail modes, QR fix, event folders, security improvements

config.py

@@ -39,3 +39,20 @@ class Config:
     
     # Default event name for migrating existing guests
     DEFAULT_EVENT_NAME = os.environ.get("DEFAULT_EVENT_NAME") or "Архивное мероприятие"
+
+    # Local timezone for display (e.g. Europe/Moscow)
+    TIMEZONE = os.environ.get("TIMEZONE") or "Europe/Moscow"
+
+    # Session security (HTTPS is required for these flags)
+    SESSION_COOKIE_SECURE = os.environ.get("SESSION_COOKIE_SECURE", "true").lower() in ["true", "1", "yes"]
+    SESSION_COOKIE_HTTPONLY = True
+    SESSION_COOKIE_SAMESITE = "Lax"
+    PERMANENT_SESSION_LIFETIME = int(os.environ.get("PERMANENT_SESSION_LIFETIME", "28800"))  # 8 часов
+
+    # CSRF protection
+    WTF_CSRF_ENABLED = True
+    WTF_CSRF_TIME_LIMIT = 3600
+
+    # Rate limiting
+    RATELIMIT_STORAGE_URI = os.environ.get("RATELIMIT_STORAGE_URI") or "memory://"
+    RATELIMIT_STRATEGY = "fixed-window"