5 Commits

Include renames

Author	SHA1	Message	Date
bruno	c718fe06de	fix: A20 (partiel) — CSP nonce par requête, unsafe-inline sort de script-src (v7.7.0) ... - ContentSecurityPolicyMiddleware : nonce aléatoire par requête dans la ContextVar `CSP_NONCE` (posée avant `call_next` → visible des templates), `script-src 'self' 'unsafe-eval' 'nonce-…'` — plus aucun script inline sans nonce ne tourne (fin des XSS injectés en JS) - 38 tags `<script>` des templates : `nonce="{{ csp_nonce() }}"` (passage scripté, vérifié : 0 restant) ; `LOCAL_LOGIN_HTML` (constante de module) : helper `_with_nonce()` au rendu ; collections.py : 3 scripts Python (chart/form/map) noncés - `<meta name="htmx-config" content='{"inlineScriptNonce": …}'>` dans base.html : htmx ré-injecte les <script> des réponses boostées avec le bon nonce - `script-src-attr 'unsafe-inline'` : les 74 handlers `onclick=` inline restent couverts (le nonce les aurait désactivés aussi) - chart.js (cdn.jsdelivr.net) et leaflet (unpkg) ajoutés à script-src/style-src : vues chart/map déjà BLOQUÉES par la CSP depuis toujours (commentaire ponytail: upgrade = vendoriser puis retirer les hôtes) - reste d'A20 : unsafe-eval (Alpine x-data → @alpinejs/csp), externalisation JS (A27), resserrer img-src/connect-src test : test_csp_nonce_per_request (page base.html + page hors template, nonce unique par requête) suite **1037/1037** · `ruff check app tests` OK · docs à jour	2026-10-01 10:41:39 -04:00
bruno	3b3e95e23a	fix(cloudflare): proteger les scripts inline des pages du Rocket Loader ... Rocket Loader (Cloudflare) reecrit les balises script inline en type=...-text/javascript et les execute de facon differee, ce qui casse l'enregistrement des composants Alpine et l'init des pages lors d'un acces direct via le tunnel (ex. /settings ne se chargeait pas au complet). Ajout de data-cfasync=false sur les scripts inline des pages completes et des partiels du shell (settings, accounts, trash, workspace, board, gitea_workspace, welcome, import, page_editor_collection/embed, _database_table_scripts, _notification_bell, public_page, local_workspace). Les fragments charges via HTMX restent inchanges.	2026-09-13 12:35:28 -04:00
bruno	1b3aed19ff	modular editor: extract original scripts into _page_editor_scripts.html ... Now 3 shared modules (zero code duplication): - _page_editor_content.html — editor HTML (title block, slash menu, toolbar etc) - _page_editor_scripts.html — 100% original editorState() JS (CMDS, render, save, slash, database, share/publish, favorites, formatting, etc) - Used by page_editor.html (full page) and page_editor_embed.html (peek iframe) Embed page_editor_embed.html now has the exact same editor as full page. One change to _page_editor_scripts.html updates both views.	2026-07-22 11:10:54 -04:00
bruno	4bceb7ce91	embed mode: force embed-mode class via JS since Jinja2 context not flowing ... The embed_mode variable set in board.py context wasn't reaching base.html through Jinja2 extends. Added document.body.classList.add in page_editor_embed.html content block to force the class, which triggers the CSS rules hiding sidebar, topbar, and header.	2026-07-22 11:00:13 -04:00
bruno	afe670bdd3	peek panels: reusable editor module — shared _page_editor_content.html + embed template ... Architecture for zero code duplication: - Extract page editor HTML into _page_editor_content.html (shared include) - page_editor.html includes it (same behavior as before) - page_editor_embed.html includes it with empty topbar (no header in peek) - board.py: ?embed=1 renders page_editor_embed.html Peek panels now load /pages/{id}?embed=1 in iframe: - Editor renders without sidebar or header breadcrumb/actions - Full editing capability (blocks, markdown, slash commands, save) - Same code — one change to _page_editor_content.html updates everywhere	2026-07-22 10:50:02 -04:00