bruno
492ae7b83b
- base.html: inject CSRF token into HTMX hx-headers via inline script - htmx:configRequest event updates CSRF on every request - HTMX loaded synchronously (no defer) so config runs before body parsed - Notes save now works, issue creation works, all POST protected
67 lines
2.3 KiB
HTML
67 lines
2.3 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="fr" data-theme="dark">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>FlowDeck</title>
|
|
<link rel="stylesheet" href="/static/css/app.css">
|
|
<script src="https://unpkg.com/[email protected]"></script>
|
|
<script src="https://unpkg.com/[email protected]" defer></script>
|
|
<script src="https://cdn.jsdelivr.net/npm/[email protected]/Sortable.min.js" defer></script>
|
|
</head>
|
|
<body hx-headers='{"X-CSRF-Token":"__CSRF_PLACEHOLDER__"}'>
|
|
<header class="app-header">
|
|
<div class="header-left">
|
|
<a href="/" class="logo">
|
|
<span class="logo-icon">▦</span>
|
|
<span class="logo-text">FlowDeck</span>
|
|
</a>
|
|
</div>
|
|
<div class="header-right">
|
|
{% if user %}
|
|
<span id="user-info">
|
|
{% if user.avatar_url %}<img src="{{ user.avatar_url }}" width="20" height="20" class="avatar">{% endif %}
|
|
{{ user.login }}
|
|
<a href="/auth/logout" class="btn btn-sm">Déconnexion</a>
|
|
</span>
|
|
{% else %}
|
|
<span id="user-info">
|
|
<a href="/auth/login" class="btn btn-sm">🔑 Login</a>
|
|
</span>
|
|
{% endif %}
|
|
<button class="theme-toggle" onclick="toggleTheme()" title="Thème clair/sombre">🌓</button>
|
|
</div>
|
|
</header>
|
|
<main class="main-content">
|
|
{% block content %}{% endblock %}
|
|
</main>
|
|
|
|
<div id="card-modal" class="modal-overlay" style="display:none">
|
|
<div class="modal-container">
|
|
<div class="modal-header">
|
|
<h3 id="card-modal-title">Détail</h3>
|
|
<button onclick="closeModal()" class="modal-close">×</button>
|
|
</div>
|
|
<div id="card-modal-content" class="modal-body"></div>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
// Inject CSRF token into HTMX headers before HTMX processes anything
|
|
(function() {
|
|
const getCsrf = () => {
|
|
const m = document.cookie.match(/csrf_token=([^;]+)/);
|
|
return m ? m[1] : '';
|
|
};
|
|
document.body.setAttribute('hx-headers', JSON.stringify({'X-CSRF-Token': getCsrf()}));
|
|
// Also update on every HTMX request
|
|
document.addEventListener('htmx:configRequest', function(evt) {
|
|
evt.detail.headers['X-CSRF-Token'] = getCsrf();
|
|
});
|
|
})();
|
|
</script>
|
|
<script src="/static/js/app.js" defer></script>
|
|
{% block scripts %}{% endblock %}
|
|
</body>
|
|
</html>
|