{% block title %}UdeS team manager{% endblock %}

{# Subresource integrity (QUA-004). Without it, whoever controls the CDN controls what runs on every page of this site — and the CSP names these hosts as allowed, so it would not object. What SRI does and does not do: it pins this exact file, so the browser refuses a version that has been altered since. It does not prove the file was honest when the hash was taken. This hash is the one cdnjs publishes for the release, not one derived from the copy we downloaded. integrity requires crossorigin. Changing the version means changing the hash, or the asset silently stops loading. #} {% if current_user.is_authenticated %}

{{ _('Dashboard') }}
{{ _('Tryouts') }}
{{ _('Calendar') }}
{{ _('Evaluations') }}
{{ _('My Team(s)') }}
{{ _('Manage Teams') }}
{{ _('Manage Users') }}
{{ _('My Notes') }}
{{ _('Notes & One on One') }}
{{ _('Contracts') }}
{{ _('My Profile') }}
{# A form, not a link: logging out is a state change, and a GET route carries no CSRF token — any site could sign the user out with an tag. Styled as a nav entry. #}
{% include "layouts/_language_switcher.html" %}

{% block header_actions %}{% endblock %}

{% with messages = get_flashed_messages(with_categories=true) %} {% if messages %} {% for category, message in messages %}

{% endfor %} {% endif %} {% endwith %}

{% block content %}{% endblock %}

{% else %}

{% with messages = get_flashed_messages(with_categories=true) %} {% if messages %} {% for category, message in messages %}

{% endfor %} {% endif %} {% endwith %}

UdeS team manager

{% include "layouts/_language_switcher.html" %}

{# The same `content` block as the signed-in branch, rendered here too — `self.content()` rather than a second `{% block %}`, which Jinja refuses. The error pages (400, 403, 404, 429, 500) all fill `content`, and it existed only inside the `is_authenticated` branch: a signed-out visitor hitting any of them got the logo, the language switcher and no message whatsoever. The still said "404", which is most of why nobody noticed. Only one branch of the `if` runs, so this never double-renders. Sign-in pages fill `auth_content` instead and leave this empty. #} {{ self.content() }} {% block auth_content %}{% endblock %} </div> </div> {% endif %} <script src="{{ url_for('static', filename='js/main.js') }}"></script> {% block scripts %}{% endblock %} </body> </html>