GGThedandClaude Opus 5
15bfebf4fc
SEC-WEB-001 / OPS-010. script-src porte toujours 'unsafe-inline' : c'est
pour cela que le XSS stocke de SEC-XSS-001 s'executait au lieu d'etre
bloque. Le retirer n'est pas un changement d'une ligne.
Ce qui bloque reellement
Un nonce autorise des elements <script> ; il ne peut rien pour un
attribut onclick="...". Mesure faite : 76 gestionnaires en ligne repartis
dans 15 gabarits. Tant qu'il en reste un, la politique ne peut pas etre
durcie.
Piege supplementaire, documente dans build_csp() : en CSP niveau 3, un
navigateur ignore 'unsafe-inline' des qu'un nonce est present. Emettre
les deux ne serait donc pas une transition douce -- ce serait couper
d'un coup tous les scripts en ligne et tous les onclick, et uniquement
sur les navigateurs recents. La bascule doit etre atomique, d'ou un
drapeau unique : CSP_ALLOW_INLINE_SCRIPT.
Infrastructure posee
build_csp() assemble l'en-tete selon le drapeau. Un nonce est genere par
requete et n'est emis que lorsque l'inline est interdit. Les 15 blocs
<script> portent deja nonce="{{ csp_nonce }}", inerte aujourd'hui : la
bascule finale sera un changement de configuration, pas de gabarits.
Couche partagee migree en premier
base.html et macros.html sont rendus sur absolument toutes les pages. Six
gestionnaires retires, remplaces par des attributs data-action et un
ecouteur delegue unique dans main.js. La delegation plutot qu'un
ecouteur par widget : le contenu injecte dynamiquement herite du
comportement sans re-attachement.
Un cliquet plutot qu'une promesse
tests/test_csp.py fixe un budget par gabarit qui ne peut que baisser.
Ajouter un gestionnaire en ligne fait echouer la suite ; en retirer sans
mettre le budget a jour aussi, ce qui force a enregistrer la progression
dans le diff. A zero, il ne reste qu'a basculer le drapeau.
Le cliquet a d'ailleurs corrige mon propre relevé : mon grep initial
comptait 83 gestionnaires, la mesure exacte en donne 76 -- le motif ne
verifiait pas l'espace avant l'attribut.
style-src conserve 'unsafe-inline' : les attributs style="" sont partout et
ne constituent pas un vecteur XSS a eux seuls. Migration distincte.
192 tests.
Co-Authored-By: Claude Opus 5 <[email protected]>
278 lines
10 KiB
HTML
278 lines
10 KiB
HTML
{% extends "layouts/base.html" %}
|
|
{% block title %}My Team(s) - TryoutPro{% endblock %}
|
|
{% block page_title %}My Team(s){% endblock %}
|
|
{% block breadcrumb %}<span class="breadcrumb">Home / My Team(s)</span>{% endblock %}
|
|
|
|
{% block content %}
|
|
{% if team_data %}
|
|
{% for item in team_data %}
|
|
{% set team = item.team %}
|
|
<div class="card mb-4">
|
|
<div class="card-header">
|
|
<h3><i class="fas fa-users"></i> {{ team.name }}</h3>
|
|
</div>
|
|
<!-- Staff bar -->
|
|
<div class="team-staff-bar">
|
|
<div class="staff-row">
|
|
<div class="staff-group">
|
|
<span class="staff-label"><i class="fas fa-chalkboard-teacher"></i> Coaches</span>
|
|
<div class="staff-items">
|
|
{% if item.coaches %}
|
|
{% for c in item.coaches %}
|
|
<span class="staff-tag">{{ c.username }}</span>
|
|
{% endfor %}
|
|
{% else %}
|
|
<span class="text-muted text-sm">None</span>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
<div class="staff-group">
|
|
<span class="staff-label"><i class="fas fa-user-tie"></i> Managers</span>
|
|
<div class="staff-items">
|
|
{% if item.managers %}
|
|
{% for m in item.managers %}
|
|
<span class="staff-tag manager-tag">{{ m.username }}</span>
|
|
{% endfor %}
|
|
{% else %}
|
|
<span class="text-muted text-sm">None</span>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="card-body">
|
|
<!-- Team Roster -->
|
|
<h4 class="mb-3"><i class="fas fa-users"></i> Team Roster</h4>
|
|
{% set roster = team.get_players_with_status() %}
|
|
{% if roster %}
|
|
<div class="table-container mb-4">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Player</th>
|
|
<th>Status</th>
|
|
<th>Position</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for entry in roster %}
|
|
<tr>
|
|
<td>
|
|
<div class="user-mini">
|
|
<div class="avatar-sm">{{ entry.player.username[:2] | upper }}</div>
|
|
<a href="{{ url_for('users.view_user', user_id=entry.player.id) }}">{{ entry.player.username }}</a>
|
|
</div>
|
|
</td>
|
|
<td>
|
|
<span class="badge {% if entry.status == 'starter' %}badge-success{% else %}badge-warning{% endif %}">
|
|
{{ entry.status | capitalize }}
|
|
</span>
|
|
</td>
|
|
<td>{{ entry.position or '—' }}</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% else %}
|
|
<div class="text-center py-3 text-muted">
|
|
<i class="fas fa-users-slash"></i> No players on this team.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<!-- Team Matches -->
|
|
<h4 class="mb-3"><i class="fas fa-futbol"></i> Upcoming Matches</h4>
|
|
{% if item.matches %}
|
|
<div class="table-container">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Match</th>
|
|
<th>Opponent</th>
|
|
<th>Date</th>
|
|
<th>Time</th>
|
|
<th>Location</th>
|
|
<th>Presence</th>
|
|
<th>My Status</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for mdata in item.matches %}
|
|
{% set tm = mdata.match %}
|
|
<tr>
|
|
<td class="cell-title">{{ tm.title }}</td>
|
|
<td>
|
|
{% if tm.opponent %}
|
|
{{ tm.opponent }}
|
|
{% else %}
|
|
<span class="badge badge-info">Practice</span>
|
|
{% endif %}
|
|
</td>
|
|
<td>{{ tm.date.strftime('%m/%d/%Y') }}</td>
|
|
<td>
|
|
{% if tm.start_time and tm.end_time %}
|
|
{{ tm.start_time.strftime('%H:%M') }} - {{ tm.end_time.strftime('%H:%M') }}
|
|
{% else %}
|
|
TBD
|
|
{% endif %}
|
|
</td>
|
|
<td>{{ tm.location or '—' }}</td>
|
|
<td>
|
|
{% if mdata.total_count > 0 %}
|
|
<span title="{{ mdata.confirmed_count }} of {{ mdata.total_count }} confirmed">
|
|
{% if mdata.confirmed_count == mdata.total_count and mdata.total_count > 0 %}
|
|
✅ {{ mdata.confirmed_count }}/{{ mdata.total_count }}
|
|
{% elif mdata.confirmed_count > 0 %}
|
|
⏳ {{ mdata.confirmed_count }}/{{ mdata.total_count }}
|
|
{% else %}
|
|
❌ 0/{{ mdata.total_count }}
|
|
{% endif %}
|
|
</span>
|
|
{% else %}
|
|
<span class="text-muted">—</span>
|
|
{% endif %}
|
|
</td>
|
|
<td>
|
|
{% if mdata.participant_id %}
|
|
<button class="btn btn-sm {% if mdata.is_confirmed %}btn-success{% else %}btn-outline{% endif %} presence-toggle-btn"
|
|
data-match-id="{{ tm.id }}"
|
|
data-participant-id="{{ mdata.participant_id }}"
|
|
onclick="togglePresence(this)">
|
|
{% if mdata.is_confirmed %}✅ Confirmed{% else %}Confirm{% endif %}
|
|
</button>
|
|
{% else %}
|
|
<span class="text-muted">—</span>
|
|
{% endif %}
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% else %}
|
|
<div class="text-center py-3 text-muted">
|
|
<i class="fas fa-calendar-alt"></i> No upcoming matches scheduled.
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
{% else %}
|
|
<div class="card">
|
|
<div class="card-body text-center py-5">
|
|
<div class="empty-state">
|
|
<i class="fas fa-users fa-3x text-muted mb-3"></i>
|
|
<h3>No Teams</h3>
|
|
<p class="text-muted">You are not currently assigned to any team.</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<script nonce="{{ csp_nonce }}">
|
|
function togglePresence(btn) {
|
|
var matchId = btn.getAttribute('data-match-id');
|
|
var participantId = btn.getAttribute('data-participant-id');
|
|
|
|
fetch('/team-matches/' + matchId + '/toggle-presence/' + participantId, {
|
|
method: 'POST',
|
|
headers: {
|
|
'X-CSRFToken': '{{ csrf_token() }}',
|
|
'Content-Type': 'application/json'
|
|
}
|
|
})
|
|
.then(function(response) { return response.json(); })
|
|
.then(function(data) {
|
|
if (data.is_confirmed) {
|
|
btn.classList.add('btn-success');
|
|
btn.classList.remove('btn-outline');
|
|
btn.innerHTML = '✅ Confirmed';
|
|
} else {
|
|
btn.classList.remove('btn-success');
|
|
btn.classList.add('btn-outline');
|
|
btn.innerHTML = 'Confirm';
|
|
}
|
|
location.reload();
|
|
})
|
|
.catch(function(error) {
|
|
console.error('Error:', error);
|
|
});
|
|
}
|
|
</script>
|
|
|
|
<style>
|
|
.team-staff-bar {
|
|
padding: 10px 20px;
|
|
background: #f8fafc;
|
|
border-bottom: 1px solid #e2e8f0;
|
|
}
|
|
.staff-row {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 24px;
|
|
flex-wrap: wrap;
|
|
}
|
|
.staff-group {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 8px;
|
|
}
|
|
.staff-label {
|
|
font-size: 0.8rem;
|
|
color: #64748b;
|
|
font-weight: 700;
|
|
text-transform: uppercase;
|
|
letter-spacing: 0.5px;
|
|
white-space: nowrap;
|
|
}
|
|
.staff-label i {
|
|
margin-right: 3px;
|
|
font-size: 0.75rem;
|
|
}
|
|
.staff-items {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 6px;
|
|
flex-wrap: wrap;
|
|
}
|
|
.staff-tag {
|
|
display: inline-flex;
|
|
align-items: center;
|
|
gap: 5px;
|
|
background: #e0e7ff;
|
|
color: #3730a3;
|
|
padding: 3px 10px;
|
|
border-radius: 14px;
|
|
font-size: 0.82rem;
|
|
font-weight: 500;
|
|
line-height: 1.3;
|
|
}
|
|
.staff-tag.manager-tag {
|
|
background: #fef3c7;
|
|
color: #92400e;
|
|
}
|
|
.text-sm {
|
|
font-size: 0.82rem;
|
|
}
|
|
.presence-toggle-btn {
|
|
min-width: 100px;
|
|
}
|
|
|
|
/* Dark mode */
|
|
[data-theme="dark"] .team-staff-bar {
|
|
background: var(--bg-tertiary);
|
|
border-bottom-color: var(--border-color);
|
|
}
|
|
[data-theme="dark"] .staff-label {
|
|
color: var(--text-muted);
|
|
}
|
|
[data-theme="dark"] .staff-tag {
|
|
background: rgba(99, 102, 241, 0.2);
|
|
color: #a5b4fc;
|
|
}
|
|
[data-theme="dark"] .staff-tag.manager-tag {
|
|
background: rgba(229, 169, 57, 0.2);
|
|
color: #fcd34d;
|
|
}
|
|
</style>
|
|
{% endblock %} |