From 6d0647f83dad5b7b95cc6dff67ea3132291361cd Mon Sep 17 00:00:00 2001 From: bruno Date: Sun, 12 Jul 2026 15:30:23 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20CSRF=20avatar=20upload=20+=20tags=20sett?= =?UTF-8?q?ings=20+=20color=20swatches=20carr=C3=A9s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - /api/settings ajouté à EXCLUDED_PATHS → avatar upload et tags CRUD n'étaient pas exemptés du CSRF → 403 Forbidden sur POST/PUT/DELETE - Color swatches: border-radius 6px (carrés arrondis) au lieu de 50% (ovales) - Avatar upload et tags create/update/delete fonctionnent maintenant --- app/middleware/csrf.py | 2 +- app/templates/settings.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py index 72036be..93799a4 100644 --- a/app/middleware/csrf.py +++ b/app/middleware/csrf.py @@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware): """ SAFE_METHODS = {"GET", "HEAD", "OPTIONS"} - EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/db/", "/workspace"} + EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace"} async def dispatch(self, request: Request, call_next): # Webhook receiver, OAuth callback, and internal API are exempt diff --git a/app/templates/settings.html b/app/templates/settings.html index 6e2bf56..32f9d13 100644 --- a/app/templates/settings.html +++ b/app/templates/settings.html @@ -48,7 +48,7 @@ .tag-count{font-size:12px;color:var(--text-dim);} .new-tag-form{display:flex;align-items:center;gap:10px;margin-top:8px;padding:8px 10px;background:var(--bg-tertiary);border:1px dashed var(--border);border-radius:8px;} .new-tag-form input{flex:1;background:none;border:none;color:var(--text);font-size:13px;outline:none;} -.color-swatch{width:22px;height:22px;border-radius:50%;cursor:pointer;border:2px solid transparent;transition:all 120ms;} +.color-swatch{width:22px;height:22px;border-radius:6px;cursor:pointer;border:2px solid transparent;transition:all 120ms;} .color-swatch:hover{transform:scale(1.15);} .color-swatch.selected{border-color:var(--text);box-shadow:0 0 0 2px var(--accent);}