GGThedandClaude Opus 5
15bfebf4fc
SEC-WEB-001 / OPS-010. script-src porte toujours 'unsafe-inline' : c'est
pour cela que le XSS stocke de SEC-XSS-001 s'executait au lieu d'etre
bloque. Le retirer n'est pas un changement d'une ligne.
Ce qui bloque reellement
Un nonce autorise des elements <script> ; il ne peut rien pour un
attribut onclick="...". Mesure faite : 76 gestionnaires en ligne repartis
dans 15 gabarits. Tant qu'il en reste un, la politique ne peut pas etre
durcie.
Piege supplementaire, documente dans build_csp() : en CSP niveau 3, un
navigateur ignore 'unsafe-inline' des qu'un nonce est present. Emettre
les deux ne serait donc pas une transition douce -- ce serait couper
d'un coup tous les scripts en ligne et tous les onclick, et uniquement
sur les navigateurs recents. La bascule doit etre atomique, d'ou un
drapeau unique : CSP_ALLOW_INLINE_SCRIPT.
Infrastructure posee
build_csp() assemble l'en-tete selon le drapeau. Un nonce est genere par
requete et n'est emis que lorsque l'inline est interdit. Les 15 blocs
<script> portent deja nonce="{{ csp_nonce }}", inerte aujourd'hui : la
bascule finale sera un changement de configuration, pas de gabarits.
Couche partagee migree en premier
base.html et macros.html sont rendus sur absolument toutes les pages. Six
gestionnaires retires, remplaces par des attributs data-action et un
ecouteur delegue unique dans main.js. La delegation plutot qu'un
ecouteur par widget : le contenu injecte dynamiquement herite du
comportement sans re-attachement.
Un cliquet plutot qu'une promesse
tests/test_csp.py fixe un budget par gabarit qui ne peut que baisser.
Ajouter un gestionnaire en ligne fait echouer la suite ; en retirer sans
mettre le budget a jour aussi, ce qui force a enregistrer la progression
dans le diff. A zero, il ne reste qu'a basculer le drapeau.
Le cliquet a d'ailleurs corrige mon propre relevé : mon grep initial
comptait 83 gestionnaires, la mesure exacte en donne 76 -- le motif ne
verifiait pas l'espace avant l'attribut.
style-src conserve 'unsafe-inline' : les attributs style="" sont partout et
ne constituent pas un vecteur XSS a eux seuls. Migration distincte.
192 tests.
Co-Authored-By: Claude Opus 5 <[email protected]>
292 lines
11 KiB
HTML
292 lines
11 KiB
HTML
{% extends "layouts/base.html" %}
|
|
{% block title %}Register - TryoutPro{% endblock %}
|
|
{% block auth_content %}
|
|
<form method="POST" action="{{ url_for('auth.register') }}" class="auth-form">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
|
|
|
<!-- ==================== Personal Info ==================== -->
|
|
<h4 class="section-title"><i class="fas fa-id-card"></i> Personal Information</h4>
|
|
<div class="form-group">
|
|
<label for="full_name"><i class="fas fa-id-card"></i> Full Name</label>
|
|
<input type="text" id="full_name" name="full_name" placeholder="Enter your full name"
|
|
value="{{ form_data.get('full_name', '') }}" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="username"><i class="fas fa-user"></i> Username</label>
|
|
<input type="text" id="username" name="username" placeholder="Choose a username"
|
|
value="{{ form_data.get('username', '') }}" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="email"><i class="fas fa-envelope"></i> Email</label>
|
|
<input type="email" id="email" name="email" placeholder="Enter your email"
|
|
value="{{ form_data.get('email', '') }}" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="phone"><i class="fas fa-phone"></i> Phone (Optional)</label>
|
|
<input type="tel" id="phone" name="phone" placeholder="Enter your phone number"
|
|
value="{{ form_data.get('phone', '') }}">
|
|
</div>
|
|
|
|
<hr class="section-divider">
|
|
|
|
<!-- ==================== Discord Connection (before games) ==================== -->
|
|
<h4 class="section-title"><i class="fab fa-discord"></i> Discord Connection</h4>
|
|
<p class="text-muted small">Connect your Discord account to automatically fill your gamertags from your connected game accounts.</p>
|
|
|
|
{% set discord_data = session.get('discord_oauth') %}
|
|
{% if discord_data %}
|
|
<div class="form-group discord-connected">
|
|
<div class="discord-connection-card">
|
|
<div class="discord-user-display">
|
|
{% if discord_data.avatar %}
|
|
{% set avatar_url = 'https://cdn.discordapp.com/avatars/' + discord_data.id|string + '/' + discord_data.avatar + '.png?size=64' %}
|
|
<img src="{{ avatar_url }}" alt="Discord Avatar" class="discord-avatar" width="48" height="48">
|
|
{% else %}
|
|
<div class="discord-avatar-placeholder">
|
|
<i class="fab fa-discord"></i>
|
|
</div>
|
|
{% endif %}
|
|
<div class="discord-user-info">
|
|
<span class="discord-username">{{ discord_data.username }}</span>
|
|
<span class="discord-connected-label text-success">
|
|
<i class="fas fa-check-circle"></i> Connected
|
|
</span>
|
|
</div>
|
|
</div>
|
|
<a href="{{ url_for('auth.discord_login') }}" class="btn btn-sm btn-outline discord-reconnect">
|
|
<i class="fas fa-sync-alt"></i> Reconnect
|
|
</a>
|
|
</div>
|
|
<input type="hidden" name="discord_username" value="{{ discord_data.username }}">
|
|
<input type="hidden" name="discord_user_id" value="{{ discord_data.id }}">
|
|
<small class="form-text text-success">
|
|
<i class="fas fa-check-circle"></i> Discord connected. Game connections have been used to pre-fill your profile below.
|
|
</small>
|
|
</div>
|
|
{% else %}
|
|
<div class="form-group discord-connect-section">
|
|
<a href="{{ url_for('auth.discord_login') }}" class="btn btn-discord btn-block">
|
|
<i class="fab fa-discord"></i> Connect Discord Account
|
|
</a>
|
|
<small class="form-text text-muted">Connect to pre-fill your gamertags from Steam, Battle.net, Xbox, etc.</small>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="discord_username"><i class="fab fa-discord"></i> Discord Username (Manual)</label>
|
|
<input type="text" id="discord_username" name="discord_username" placeholder="e.g. YourName"
|
|
value="{{ form_data.get('discord_username', '') }}">
|
|
</div>
|
|
{% endif %}
|
|
|
|
<hr class="section-divider">
|
|
|
|
<!-- ==================== E-Sports Profile ==================== -->
|
|
<h4 class="section-title"><i class="fas fa-gamepad"></i> E-Sports Profile</h4>
|
|
<p class="text-muted small">Set up your competitive gaming profile for tryouts.</p>
|
|
|
|
<div class="form-group">
|
|
<label><i class="fas fa-headset"></i> Games You Play</label>
|
|
<div class="checkbox-grid">
|
|
{% set selected_games = form_data.get('games', []) %}
|
|
{% set auto_select = session.get('discord_oauth', {}).get('auto_select_games', []) %}
|
|
{% for game in esport_games %}
|
|
{% set is_checked = game in selected_games or (not form_data and game in auto_select) %}
|
|
<label class="checkbox-label">
|
|
<input type="checkbox" name="games" value="{{ game }}"
|
|
{% if is_checked %}checked{% endif %}
|
|
onchange="toggleGamertagInput(this)">
|
|
<span>{{ game }}</span>
|
|
</label>
|
|
{% endfor %}
|
|
</div>
|
|
<small class="form-text text-muted">Select all games you're signing in for.</small>
|
|
</div>
|
|
|
|
<!-- Gamertag fields per game -->
|
|
{% set discord_suggestions = session.get('discord_oauth', {}).get('gamertag_suggestions', {}) %}
|
|
{% for game in esport_games %}
|
|
{% set game_id = game|replace(' ', '_') %}
|
|
{% set form_gamertag = form_data.get('gamertag_' ~ game, '') if form_data else '' %}
|
|
{% set suggested = discord_suggestions.get(game, '') %}
|
|
{% set gamertag_val = form_gamertag if form_gamertag else suggested %}
|
|
{% set game_checked = (form_data and game in selected_games) or (not form_data and game in auto_select) %}
|
|
{% set is_visible = gamertag_val or game_checked %}
|
|
<div class="form-group gamertag-group" id="gamertag_group_{{ game_id }}"
|
|
style="{% if is_visible %}display:block{% else %}display:none{% endif %}">
|
|
<label for="gamertag_{{ game }}"><i class="fas fa-gamepad"></i> {{ game }} Gamertag</label>
|
|
<input type="text" id="gamertag_{{ game }}" name="gamertag_{{ game }}"
|
|
placeholder="Enter your {{ game }} username"
|
|
value="{{ gamertag_val }}">
|
|
<small class="form-text text-muted">
|
|
Your in-game name for {{ game }}.
|
|
{% if suggested and not form_gamertag %}
|
|
<span class="text-success">Pre-filled from Discord connections.</span>
|
|
{% endif %}
|
|
</small>
|
|
</div>
|
|
{% endfor %}
|
|
|
|
<div class="form-group">
|
|
<label for="league_os_profile"><i class="fas fa-link"></i> League OS Connection (Optional)</label>
|
|
<input type="text" id="league_os_profile" name="league_os_profile"
|
|
placeholder="League OS profile link or ID"
|
|
value="{{ form_data.get('league_os_profile', '') }}">
|
|
<small class="form-text text-muted">Connect your League OS profile for organized play.</small>
|
|
</div>
|
|
|
|
<hr class="section-divider">
|
|
<h4 class="section-title"><i class="fas fa-shield-alt"></i> Security</h4>
|
|
<div class="form-group">
|
|
<label for="password"><i class="fas fa-lock"></i> Password</label>
|
|
<input type="password" id="password" name="password" placeholder="Create a password"
|
|
required minlength="6">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="confirm_password"><i class="fas fa-check-circle"></i> Confirm Password</label>
|
|
<input type="password" id="confirm_password" name="confirm_password" placeholder="Confirm your password"
|
|
required>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="captcha_answer"><i class="fas fa-calculator"></i> {{ captcha.question }}</label>
|
|
<input type="number" id="captcha_answer" name="captcha_answer" placeholder="Answer" required autocomplete="off">
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-primary btn-block">Create Account</button>
|
|
<p class="auth-link">Already have an account? <a href="{{ url_for('auth.login') }}">Sign in</a></p>
|
|
</form>
|
|
|
|
<script nonce="{{ csp_nonce }}">
|
|
// Toggle gamertag input visibility when a game checkbox is checked/unchecked
|
|
function toggleGamertagInput(checkbox) {
|
|
var game = checkbox.value.replace(/ /g, '_');
|
|
var group = document.getElementById('gamertag_group_' + game);
|
|
if (group) {
|
|
group.style.display = checkbox.checked ? 'block' : 'none';
|
|
}
|
|
}
|
|
|
|
// On page load, ensure gamertag groups match checkbox state
|
|
document.addEventListener('DOMContentLoaded', function() {
|
|
var checkboxes = document.querySelectorAll('input[name="games"]');
|
|
checkboxes.forEach(function(checkbox) {
|
|
toggleGamertagInput(checkbox);
|
|
});
|
|
});
|
|
</script>
|
|
|
|
<style>
|
|
/* Discord Connection Card */
|
|
.discord-connection-card {
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: space-between;
|
|
background: #2f3136;
|
|
border: 1px solid #40444b;
|
|
border-radius: 8px;
|
|
padding: 12px 16px;
|
|
margin-top: 4px;
|
|
}
|
|
.discord-user-display {
|
|
display: flex;
|
|
align-items: center;
|
|
gap: 12px;
|
|
}
|
|
.discord-avatar {
|
|
border-radius: 50%;
|
|
border: 2px solid #5865F2;
|
|
}
|
|
.discord-avatar-placeholder {
|
|
width: 48px;
|
|
height: 48px;
|
|
border-radius: 50%;
|
|
background: #5865F2;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
font-size: 22px;
|
|
color: #fff;
|
|
}
|
|
.discord-user-info {
|
|
display: flex;
|
|
flex-direction: column;
|
|
}
|
|
.discord-username {
|
|
font-weight: 600;
|
|
font-size: 15px;
|
|
color: #fff;
|
|
}
|
|
.discord-connected-label {
|
|
font-size: 12px;
|
|
font-weight: 500;
|
|
}
|
|
.discord-connect-section {
|
|
background: #2f3136;
|
|
border: 1px dashed #5865F2;
|
|
border-radius: 8px;
|
|
padding: 16px;
|
|
text-align: center;
|
|
}
|
|
.discord-connect-section label {
|
|
display: block;
|
|
margin-bottom: 8px;
|
|
}
|
|
.btn-discord {
|
|
background-color: #5865F2;
|
|
color: #fff;
|
|
border: none;
|
|
padding: 10px 20px;
|
|
border-radius: 6px;
|
|
font-size: 15px;
|
|
font-weight: 600;
|
|
cursor: pointer;
|
|
text-decoration: none;
|
|
display: inline-flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
gap: 8px;
|
|
transition: background-color 0.2s;
|
|
width: 100%;
|
|
}
|
|
.btn-discord:hover {
|
|
background-color: #4752C4;
|
|
color: #fff;
|
|
}
|
|
.btn-outline {
|
|
background: transparent;
|
|
color: #5865F2;
|
|
border: 1px solid #5865F2;
|
|
padding: 6px 12px;
|
|
border-radius: 6px;
|
|
font-size: 12px;
|
|
cursor: pointer;
|
|
text-decoration: none;
|
|
display: inline-flex;
|
|
align-items: center;
|
|
gap: 4px;
|
|
transition: background-color 0.2s;
|
|
white-space: nowrap;
|
|
}
|
|
.btn-outline:hover {
|
|
background-color: #5865F2;
|
|
color: #fff;
|
|
}
|
|
.discord-reconnect {
|
|
font-size: 11px;
|
|
}
|
|
.btn-sm {
|
|
padding: 4px 8px;
|
|
font-size: 12px;
|
|
}
|
|
.gamertag-group {
|
|
margin-bottom: 12px;
|
|
}
|
|
.gamertag-group label {
|
|
font-size: 13px;
|
|
font-weight: 500;
|
|
margin-bottom: 4px;
|
|
}
|
|
.text-success {
|
|
color: #57F287 !important;
|
|
}
|
|
</style>
|
|
{% endblock %} |