Merge branch 'audit/securite-maintenabilite-standards' of https://git.immortal.host/clubesportsudes/team-tryouts into audit/securite-maintenabilite-standards

app/templates/pages/coach_availability.html

@@ -216,7 +216,14 @@ function flash(message, type) {
     const flashContainer = document.querySelector('.flash-messages');
     const alert = document.createElement('div');
     alert.className = 'alert alert-' + type + ' alert-dismissible';
-    alert.innerHTML = '<span>' + message + '</span><button type="button" class="alert-close" data-action="remove-element">&times;</button>';
+    const text = document.createElement('span');
+    text.textContent = message;
+    const close = document.createElement('button');
+    close.type = 'button';
+    close.className = 'alert-close';
+    close.dataset.action = 'remove-element';
+    close.textContent = '×';
+    alert.append(text, close);
     flashContainer.appendChild(alert);
 }
 

app/templates/pages/edit_profile.html

@@ -79,14 +79,13 @@
             </div>
 
             <div class="form-row">
-                <div class="form-group col-6">
+                <div class="form-group col-12">
                     <label for="discord_username"><i class="fab fa-discord"></i> {{ _('Discord Username') }}</label>
                     <input type="text" id="discord_username" name="discord_username" value="{{ user.discord_username or '' }}" placeholder="{{ _('e.g. Name#1234') }}">
-                </div>
-                <div class="form-group col-6">
-                    <label for="discord_user_id"><i class="fab fa-discord"></i> Discord User ID <small>{{ _('(for DMs)') }}</small></label>
-                    <input type="text" id="discord_user_id" name="discord_user_id" value="{{ user.discord_user_id or '' }}" placeholder="{{ _('Numeric ID (e.g. 123456789012345678)') }}">
-                    <small class="text-muted">{{ _('Enable Developer Mode in Discord → Right-click profile → Copy ID') }}</small>
+                    <a href="{{ url_for('auth.discord_login') }}" class="btn btn-secondary mt-2">
+                        <i class="fab fa-discord"></i>
+                        {% if user.discord_user_id %}{{ _('Reconnect') }}{% else %}{{ _('Connect Discord Account') }}{% endif %}
+                    </a>
                 </div>
             </div>
             <div class="form-row">

app/templates/pages/match_form.html

@@ -450,11 +450,18 @@
 var playerDataById = {
     player_data: {
 {%- for p in all_players %}
-        {{ p.id }}: "{{ p.username | escape }}",
+        {{ p.id }}: {{ p.username | tojson }},
 {%- endfor %}
     }
 };
 
+var HTML_ESCAPES = {'&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'};
+function escapeHtml(value) {
+    return String(value).replace(/[&<>"']/g, function (character) {
+        return HTML_ESCAPES[character];
+    });
+}
+
 // All registered player IDs
 var allRegisteredPlayers = [
 {%- for p in all_players %}
@@ -555,7 +562,7 @@ document.addEventListener('DOMContentLoaded', function() {
         var playerName = playerDataById.player_data[pid];
         if (playerName) {
             var html = '<div class="player-item" data-player-id="' + pid + '" data-action="return-to-pool">';
-            html += playerName;
+            html += escapeHtml(playerName);
             html += '<span class="remove-btn">↺</span>';
             html += '</div>';
             teamDiv.insertAdjacentHTML('beforeend', html);
@@ -568,7 +575,7 @@ document.addEventListener('DOMContentLoaded', function() {
         var playerName = playerDataById.player_data[pid];
         if (playerName) {
             var html = '<div class="player-item" data-player-id="' + pid + '" data-action="return-to-pool">';
-            html += playerName;
+            html += escapeHtml(playerName);
             html += '<span class="remove-btn">↺</span>';
             html += '</div>';
             teamDiv.insertAdjacentHTML('beforeend', html);
@@ -661,7 +668,7 @@ function renderMergedDisponibilityGrid() {
             }
             
             dayRow += '<div class="' + cssClass + '" data-day="' + day.value + '" data-time="' + slotData.time + '" ' +
-                       'onclick="toggleTimeSlot(' + day.value + ', \'' + slotData.time + '\', this)">' +
+                       'data-action="toggle-time-slot">' +
                        slotData.display +
                        '<span class="merged-disponibility-count">' + count + '</span>' +
                        '</div>';
@@ -920,7 +927,7 @@ function updatePlayerPool() {
         var availabilityClass = isAvailable ? 'available' : 'unavailable';
         
         html += '<div class="player-item ' + availabilityClass + '" data-player-id="' + pid + '">';
-        html += '<span class="player-name">' + playerName + '</span>';
+        html += '<span class="player-name">' + escapeHtml(playerName) + '</span>';
         html += '<div class="player-actions">';
         html += '<button type="button" class="btn btn-sm btn-primary" data-action="assign-team" data-team-side="1">{{ _('T1') }}</button>';
         html += '<button type="button" class="btn btn-sm btn-secondary" data-action="assign-team" data-team-side="2">{{ _('T2') }}</button>';
@@ -943,7 +950,7 @@ function assignToTeam(playerId, teamSide) {
     if (!playerName) return;
     
     var html = '<div class="player-item" data-player-id="' + playerId + '" data-action="return-to-pool">';
-    html += playerName;
+    html += escapeHtml(playerName);
     html += '<span class="remove-btn">↺</span>';
     html += '</div>';
     
@@ -1062,7 +1069,7 @@ function randomizeTeams() {
         var playerName = playerDataById.player_data[pid];
         if (playerName) {
             var html = '<div class="player-item" data-player-id="' + pid + '" data-action="return-to-pool">';
-            html += playerName;
+            html += escapeHtml(playerName);
             html += '<span class="remove-btn">↺</span>';
             html += '</div>';
             teamDiv.insertAdjacentHTML('beforeend', html);
@@ -1074,7 +1081,7 @@ function randomizeTeams() {
         var playerName = playerDataById.player_data[pid];
         if (playerName) {
             var html = '<div class="player-item" data-player-id="' + pid + '" data-action="return-to-pool">';
-            html += playerName;
+            html += escapeHtml(playerName);
             html += '<span class="remove-btn">↺</span>';
             html += '</div>';
             teamDiv.insertAdjacentHTML('beforeend', html);
@@ -1120,6 +1127,11 @@ function togglePresence(matchId, participantId, badgeEl) {
 registerActions({
     'toggle-match-type': toggleMatchType,
     'clear-time-selection': clearTimeSelection,
+    'toggle-time-slot': function (element) {
+        toggleTimeSlot(parseInt(element.getAttribute('data-day'), 10),
+                       element.getAttribute('data-time'),
+                       element);
+    },
     'update-randomize-preview': updateRandomizePreview,
     'randomize-teams': randomizeTeams,
     'return-to-pool': returnToPool,

app/templates/pages/profile.html

@@ -193,8 +193,8 @@
                 <p class="text-muted">{{ _('Loading...') }}</p>
             </div>
             <div class="form-actions">
-                <button type="button" class="btn btn-secondary" onclick="clearDisponibilities()">
-                    <i class="fas fa-trash"></i> Clear All
+                <button type="button" class="btn btn-secondary" data-action="clear-disponibilities">
+                    <i class="fas fa-trash"></i> {{ _('Clear All') }}
                 </button>
             </div>
         </div>
@@ -607,7 +607,6 @@ document.addEventListener('DOMContentLoaded', function() {
 // dispatched by the delegated listener in main.js. This replaces inline
 // onclick attributes, which no CSP nonce is able to authorise.
 registerActions({
-    'save-disponibilities': saveDisponibilities,
     'clear-disponibilities': clearDisponibilities,
     'clear-availability': clearAllAvailability,
 });

app/templates/pages/register.html

@@ -57,8 +57,6 @@
                 <i class="fas fa-sync-alt"></i> {{ _('Reconnect') }}
             </a>
         </div>
-        <input type="hidden" name="discord_username" value="{{ discord_data.username }}">
-        <input type="hidden" name="discord_user_id" value="{{ discord_data.id }}">
         <small class="form-text text-success">
             <i class="fas fa-check-circle"></i> {{ _('Discord connected. Game connections have been used to pre-fill your profile below.') }}
         </small>