GGThed
70db8a7491
OBS-005. Un 500 dans errors.log et les six lignes de app.log qui y menent n etaient relies que par leur horodatage — ce qui n est pas une relation des que le serveur traite plus d une requete a la fois. Et un utilisateur qui dit « ca a plante quand j ai clique sur enregistrer » ne donnait a personne de quoi chercher. Chaque requete recoit un identifiant, porte par toutes les lignes de journal qu elle produit, renvoye en X-Request-Id, et affiche sur la page 500 comme reference a citer. Il est **genere**, jamais lu depuis un en-tete entrant. Accepter celui du client serait pratique pour tracer a travers nginx, et permettrait aussi a n importe qui d ecrire du texte arbitraire — retours a la ligne compris — dans le fichier de journal. C est ainsi qu un journal cesse d etre une preuve. Il n y a de toute facon aucun proxy de confiance tant qu OPS-002 est ouvert. Le test correspondant assure sur l alphabet plutot qu en envoyant un retour a la ligne : le client de test de Werkzeug refuse d emettre un tel en-tete, donc l attaque ne peut meme pas etre construite par la, ce qui ne prouverait rien sur l application. **Defaut trouve en chemin, et repare.** Les cinq gabarits d erreur remplissent le bloc `content`, qui n existait que dans la branche authentifiee de la mise en page. Un visiteur deconnecte tombant sur une erreur — donc typiquement sur la page de connexion — recevait le logo, le selecteur de langue, et **aucun message**. Le code de statut etait bon, les journaux etaient bons, la page etait vide. Le <title> disait quand meme « 404 », ce qui explique en grande partie que personne ne l ait vu. Le bloc est desormais rendu dans les deux branches via self.content(), Jinja refusant deux blocs de meme nom. Un seul cote du if s execute, donc jamais de double rendu — et c est assure, pas suppose. 550 tests.
226 lines
11 KiB
HTML
226 lines
11 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="{{ current_locale }}">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>{% block title %}Team Tryout Management{% endblock %}</title>
|
|
{# Subresource integrity (QUA-004). Without it, whoever controls the CDN
|
|
controls what runs on every page of this site — and the CSP names these
|
|
hosts as allowed, so it would not object.
|
|
|
|
What SRI does and does not do: it pins this exact file, so the browser
|
|
refuses a version that has been altered since. It does not prove the
|
|
file was honest when the hash was taken. This hash is the one cdnjs
|
|
publishes for the release, not one derived from the copy we downloaded.
|
|
|
|
integrity requires crossorigin. Changing the version means changing
|
|
the hash, or the asset silently stops loading. #}
|
|
<link rel="stylesheet"
|
|
href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css"
|
|
integrity="sha512-DTOQO9RWCH3ppGqcWaEA1BIZOC6xxalwEsw9c2QQeAIftl+Vegovlnee1c9QX4TctnWMn13TZye+giMm8e2LwA=="
|
|
crossorigin="anonymous"
|
|
referrerpolicy="no-referrer">
|
|
<link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
|
|
<link rel="icon" type="image/svg+xml" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🏆</text></svg>">
|
|
</head>
|
|
<body>
|
|
{% if current_user.is_authenticated %}
|
|
<nav class="sidebar" id="sidebar">
|
|
<div class="sidebar-header">
|
|
<div class="logo">
|
|
<i class="fas fa-trophy"></i>
|
|
<span>TryoutPro</span>
|
|
</div>
|
|
<div class="user-badge">
|
|
<div class="user-avatar">
|
|
{{ current_user.username[:2] | upper }}
|
|
</div>
|
|
<div class="user-info">
|
|
<span class="user-name">{{ current_user.username }}</span>
|
|
<span class="user-role role-{{ current_user.role }}">{{ current_user.role | capitalize }}</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<ul class="nav-links">
|
|
<li>
|
|
<a href="{{ url_for('main.dashboard') }}" class="{% if request.endpoint and 'dashboard' in request.endpoint %}active{% endif %}">
|
|
<i class="fas fa-th-large"></i>
|
|
<span>{{ _('Dashboard') }}</span>
|
|
</a>
|
|
</li>
|
|
<li>
|
|
<a href="{{ url_for('tryouts.list_tryouts') }}" class="{% if request.endpoint and 'tryouts' in request.endpoint and request.endpoint != 'tryouts.create_tryout' %}active{% endif %}">
|
|
<i class="fas fa-calendar-alt"></i>
|
|
<span>{{ _('Tryouts') }}</span>
|
|
</a>
|
|
</li>
|
|
<li>
|
|
<a href="{{ url_for('matches.calendar') }}" class="{% if request.endpoint and 'calendar' in request.endpoint %}active{% endif %}">
|
|
<i class="fas fa-calendar"></i>
|
|
<span>{{ _('Calendar') }}</span>
|
|
</a>
|
|
</li>
|
|
{% if current_user.can_evaluate() %}
|
|
<li>
|
|
<a href="{{ url_for('evaluations.list_evaluations') }}" class="{% if request.endpoint and 'evaluations' in request.endpoint %}active{% endif %}">
|
|
<i class="fas fa-clipboard-check"></i>
|
|
<span>{{ _('Evaluations') }}</span>
|
|
</a>
|
|
</li>
|
|
{% endif %}
|
|
{% if current_user.role == 'player' %}
|
|
<li>
|
|
<a href="{{ url_for('teams.my_teams') }}" class="{% if request.endpoint == 'teams.my_teams' %}active{% endif %}">
|
|
<i class="fas fa-users"></i>
|
|
<span>{{ _('My Team(s)') }}</span>
|
|
</a>
|
|
</li>
|
|
{% else %}
|
|
<li>
|
|
<a href="{{ url_for('teams.list_teams') }}" class="{% if request.endpoint and 'teams' in request.endpoint and request.endpoint != 'teams.my_teams' %}active{% endif %}">
|
|
<i class="fas fa-users-cog"></i>
|
|
<span>{{ _('Manage Teams') }}</span>
|
|
</a>
|
|
</li>
|
|
{% endif %}
|
|
{% if current_user.can_manage_users() %}
|
|
<li>
|
|
<a href="{{ url_for('users.list_users') }}" class="{% if request.endpoint and 'users' in request.endpoint and request.endpoint != 'users.profile' %}active{% endif %}">
|
|
<i class="fas fa-users-cog"></i>
|
|
<span>{{ _('Manage Users') }}</span>
|
|
</a>
|
|
</li>
|
|
{% endif %}
|
|
{% if current_user.role == 'player' %}
|
|
<li>
|
|
<a href="{{ url_for('users.my_notes') }}" class="{% if request.endpoint == 'users.my_notes' %}active{% endif %}">
|
|
<i class="fas fa-sticky-note"></i>
|
|
<span>{{ _('My Notes') }}</span>
|
|
</a>
|
|
</li>
|
|
{% endif %}
|
|
{% if current_user.role == 'coach' %}
|
|
<li>
|
|
<a href="{{ url_for('users.manage_coach_availability') }}" class="{% if request.endpoint == 'users.manage_coach_availability' %}active{% endif %}">
|
|
<i class="fas fa-clock"></i>
|
|
<span>{{ _('Availability') }}</span>
|
|
</a>
|
|
</li>
|
|
<li>
|
|
<a href="{{ url_for('users.notes_dashboard') }}" class="{% if request.endpoint == 'users.notes_dashboard' or request.endpoint == 'users.manage_team_notes' or request.endpoint == 'users.manage_personal_notes' %}active{% endif %}">
|
|
<i class="fas fa-sticky-note"></i>
|
|
<span>{{ _('Notes & One on One') }}</span>
|
|
</a>
|
|
</li>
|
|
{% endif %}
|
|
<li>
|
|
<a href="{{ url_for('users.list_contracts') }}" class="{% if request.endpoint and 'contracts' in request.endpoint %}active{% endif %}">
|
|
<i class="fas fa-file-contract"></i>
|
|
<span>{{ _('Contracts') }}</span>
|
|
</a>
|
|
</li>
|
|
<li class="nav-divider"></li>
|
|
<li>
|
|
<a href="{{ url_for('users.profile') }}" class="{% if request.endpoint == 'users.profile' %}active{% endif %}">
|
|
<i class="fas fa-user"></i>
|
|
<span>{{ _('My Profile') }}</span>
|
|
</a>
|
|
</li>
|
|
<li>
|
|
{# A form, not a link: logging out is a state change, and a
|
|
GET route carries no CSRF token — any site could sign the
|
|
user out with an <img> tag. Styled as a nav entry. #}
|
|
<form method="POST" action="{{ url_for('auth.logout') }}" class="nav-form">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
|
<button type="submit" class="logout-link">
|
|
<i class="fas fa-sign-out-alt"></i>
|
|
<span>{{ _('Logout') }}</span>
|
|
</button>
|
|
</form>
|
|
</li>
|
|
<li class="nav-divider"></li>
|
|
<li class="nav-language">
|
|
{% include "layouts/_language_switcher.html" %}
|
|
</li>
|
|
</ul>
|
|
</nav>
|
|
|
|
<div class="main-content" id="mainContent">
|
|
<header class="top-bar">
|
|
<button class="sidebar-toggle" id="sidebarToggle" data-action="toggle-sidebar">
|
|
<i class="fas fa-bars"></i>
|
|
</button>
|
|
<div class="page-header">
|
|
<h1>{% block page_title %}{{ _('Dashboard') }}{% endblock %}</h1>
|
|
{% block breadcrumb %}{% endblock %}
|
|
</div>
|
|
<button class="dark-mode-toggle" id="darkModeToggle" data-action="toggle-dark-mode"
|
|
title="{{ _('Toggle dark mode') }}">
|
|
<i class="fas fa-moon"></i>
|
|
</button>
|
|
{% block header_actions %}{% endblock %}
|
|
</header>
|
|
<div class="flash-messages">
|
|
{% with messages = get_flashed_messages(with_categories=true) %}
|
|
{% if messages %}
|
|
{% for category, message in messages %}
|
|
<div class="alert alert-{{ category }} alert-dismissible">
|
|
<span>{{ message }}</span>
|
|
<button type="button" class="alert-close" data-action="dismiss-alert"
|
|
aria-label="{{ _('Dismiss') }}">×</button>
|
|
</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endwith %}
|
|
</div>
|
|
<div class="content">
|
|
{% block content %}{% endblock %}
|
|
</div>
|
|
</div>
|
|
{% else %}
|
|
<div class="auth-wrapper">
|
|
<div class="flash-messages">
|
|
{% with messages = get_flashed_messages(with_categories=true) %}
|
|
{% if messages %}
|
|
{% for category, message in messages %}
|
|
<div class="alert alert-{{ category }} alert-dismissible">
|
|
<span>{{ message }}</span>
|
|
<button type="button" class="alert-close" data-action="dismiss-alert"
|
|
aria-label="{{ _('Dismiss') }}">×</button>
|
|
</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endwith %}
|
|
</div>
|
|
<div class="auth-container">
|
|
<div class="auth-header">
|
|
<i class="fas fa-trophy"></i>
|
|
<h2>TryoutPro</h2>
|
|
<p>{{ _('Team Tryout Management System') }}</p>
|
|
</div>
|
|
<div class="auth-language">
|
|
{% include "layouts/_language_switcher.html" %}
|
|
</div>
|
|
{# The same `content` block as the signed-in branch, rendered
|
|
here too — `self.content()` rather than a second
|
|
`{% block %}`, which Jinja refuses.
|
|
|
|
The error pages (400, 403, 404, 429, 500) all fill `content`,
|
|
and it existed only inside the `is_authenticated` branch: a
|
|
signed-out visitor hitting any of them got the logo, the
|
|
language switcher and no message whatsoever. The <title> still
|
|
said "404", which is most of why nobody noticed.
|
|
|
|
Only one branch of the `if` runs, so this never double-renders.
|
|
Sign-in pages fill `auth_content` instead and leave this
|
|
empty. #}
|
|
{{ self.content() }}
|
|
{% block auth_content %}{% endblock %}
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<script src="{{ url_for('static', filename='js/main.js') }}"></script>
|
|
{% block scripts %}{% endblock %}
|
|
</body>
|
|
</html> |