bruno
c718fe06de
- ContentSecurityPolicyMiddleware : nonce aléatoire par requête dans la
ContextVar `CSP_NONCE` (posée avant `call_next` → visible des templates),
`script-src 'self' 'unsafe-eval' 'nonce-…'` — plus aucun script inline
sans nonce ne tourne (fin des XSS injectés en JS)
- 38 tags `<script>` des templates : `nonce="{{ csp_nonce() }}"` (passage
scripté, vérifié : 0 restant) ; `LOCAL_LOGIN_HTML` (constante de module) :
helper `_with_nonce()` au rendu ; collections.py : 3 scripts Python
(chart/form/map) noncés
- `<meta name="htmx-config" content='{"inlineScriptNonce": …}'>` dans base.html
: htmx ré-injecte les <script> des réponses boostées avec le bon nonce
- `script-src-attr 'unsafe-inline'` : les 74 handlers `onclick=` inline
restent couverts (le nonce les aurait désactivés aussi)
- chart.js (cdn.jsdelivr.net) et leaflet (unpkg) ajoutés à script-src/style-src
: vues chart/map déjà BLOQUÉES par la CSP depuis toujours
(commentaire ponytail: upgrade = vendoriser puis retirer les hôtes)
- reste d'A20 : unsafe-eval (Alpine x-data → @alpinejs/csp), externalisation
JS (A27), resserrer img-src/connect-src
test : test_csp_nonce_per_request (page base.html + page hors template,
nonce unique par requête)
suite **1037/1037** · `ruff check app tests` OK · docs à jour
70 lines
3.2 KiB
HTML
70 lines
3.2 KiB
HTML
<!-- Detailed Board — Notion style with all card properties visible -->
|
|
<div id="view-content" class="kanban-container" x-data="kanbanBoard()">
|
|
{% set statuses = [('todo', 'To-do', 'var(--gray)'), ('progress', 'In progress', 'var(--blue)'), ('done', 'Complete', 'var(--green)')] %}
|
|
{% for status, label, color in statuses %}
|
|
<div class="kanban-column">
|
|
<div class="kanban-column-header">
|
|
<span class="col-dot" style="background: {{ color }};"></span>
|
|
{{ label }}
|
|
<span class="col-count">{{ groups|map(attribute='counts')|map(attribute=status)|sum }}</span>
|
|
</div>
|
|
{% for group in groups %}
|
|
<div class="kanban-group-header" @click="toggleGroup('{{ group.id }}')">
|
|
<span class="group-chevron" :class="{ 'open': !collapsedGroups.includes('{{ group.id }}') }">▶</span>
|
|
{{ group.name }}
|
|
<span class="group-count">{{ group.counts[status] }}</span>
|
|
</div>
|
|
<div class="kanban-cards" x-show="!collapsedGroups.includes('{{ group.id }}')"
|
|
data-group="{{ group.id }}" data-status="{{ status }}">
|
|
{% for card in group.cards if card.status == status %}
|
|
<div class="kanban-card card-status-{{ card.status }}"
|
|
data-card-id="{{ card.id }}" style="padding: 14px;">
|
|
<div class="card-header">
|
|
<span class="card-icon">{{ card.icon }}</span>
|
|
<span class="card-title" style="font-size:14px; font-weight:600;">{{ card.title }}</span>
|
|
</div>
|
|
<div class="card-meta" style="flex-direction:column; gap:6px; margin-top:10px;">
|
|
{% if card.assignee %}
|
|
<div class="card-assignee">
|
|
<div class="card-avatar" style="width:22px; height:22px; font-size:11px;">{{ card.assignee[0] }}</div>
|
|
<span style="font-size:13px;">{{ card.assignee }}</span>
|
|
</div>
|
|
{% endif %}
|
|
{% if card.tag %}
|
|
<div>
|
|
<span class="card-tag" style="background:{{ card.tag_color }}20; color:{{ card.tag_color }}; font-size:12px; padding:2px 8px;">
|
|
{{ card.tag }}
|
|
</span>
|
|
</div>
|
|
{% endif %}
|
|
{% if card.due_date %}
|
|
<div class="card-date">
|
|
<span>{{ fd_icon("calendar",14) }}</span>
|
|
<span style="font-size:12px;">{{ card.due_date }}</span>
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
<div style="position:absolute; top:8px; right:8px; opacity:0; transition:opacity 0.15s;"
|
|
onmouseover="this.style.opacity='1'" onmouseout="this.style.opacity='0'"
|
|
onclick="event.stopPropagation(); openCardDetail('{{ card.id }}')">
|
|
<button class="item-action-btn" title="Open detail">↗</button>
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
<button class="kanban-new-card" @click="newCard('{{ group.id }}', '{{ status }}')">+ New page</button>
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
|
|
<script nonce="{{ csp_nonce() }}">
|
|
function openCardDetail(id) {
|
|
htmx.ajax('GET', `/api/issues/${owner}/${repo}/${id}?format=html`, {
|
|
target: '#card-modal-content', swap: 'innerHTML'
|
|
});
|
|
document.getElementById('card-modal').style.display = 'flex';
|
|
document.getElementById('card-modal-title').textContent = 'Issue #' + id;
|
|
}
|
|
</script>
|