Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

@@ -112,7 +112,7 @@ def _configure_session(cls, app):
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
-        app.config["SESSION_COOKIE_SAMESITE"] = "None"
+        app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 

@@ -66,13 +66,12 @@ package_dir =
     = src
 install_requires =
     Cheroot~=8.4
-    Flask;python_version<"3.8"
-    Flask~=2.3.0;python_version>="3.8"
+    Flask
     Flask-Babel~=1.0
     Flask-Caching~=1.9
     Flask-Compress~=1.8
-    Flask-Session~=0.3;python_version<"3.7"
-    Flask-Session2~=1.3;python_version>="3.7"
+    Flask-Session~=0.4.1;python_version<"3.7"
+    Flask-Session;python_version>="3.7"
     Flask-Themes2~=1.0
     bitmath~=1.3
     cryptography>=35.0.0;platform_python_implementation!="PyPy"

@@ -112,6 +112,7 @@ def _configure_session(cls, app):
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
+        app.config["SESSION_COOKIE_SAMESITE"] = "None"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False