GGThedandClaude Opus 5
fcb58e8a17
SEC-WEB-001 / OPS-010, ferme. C'est cette directive qui laissait s'executer
le XSS stocke de SEC-XSS-001 au lieu de le bloquer.
Les cinq derniers gabarits sont migres : match_form 13, calendar 11,
teams 11, evaluate_player 9, view_tryout 8. Total sur le chantier : 82
gestionnaires en ligne retires dans 17 gabarits. Il n'en reste aucun.
Deux motifs generiques de plus dans main.js
data-mirror affichage direct de la valeur d'un curseur.
evaluate_player repetait le meme
oninput="this.nextElementSibling.textContent = ..."
sur ses neuf curseurs de note.
data-submit-on-change remplace onchange="this.form.submit()"
Markup genere dans des chaines JavaScript
match_form construisait sept gestionnaires par concatenation, en y
injectant l'identifiant du joueur. Le markup portait deja data-player-id :
returnToPool et assignToTeam lisent desormais leurs arguments depuis
l'element clique. Cela supprime a la fois l'attribut en ligne et la
concatenation qui l'alimentait. Meme motif que dans coach_availability.
Bascule
CSP_ALLOW_INLINE_SCRIPT passe a false. script-src vaut maintenant
'self' 'nonce-<aleatoire par requete>' https://cdn.jsdelivr.net.
La variable d'environnement reste, comme issue de secours si un
deploiement rencontrait un gestionnaire oublie -- mais la laisser active
revient a renoncer a la protection.
Le cliquet devient une garde
Le budget par gabarit est vide et les tests deviennent absolus : aucun
gestionnaire en ligne, et tout bloc <script> inline doit porter son
nonce. Sans nonce, un bloc n'est simplement pas execute, et rien dans les
journaux ne le signale -- d'ou le test.
Verifications
22 pages parcourues avec les trois roles : toutes rendent en 200, aucune
ne contient de gestionnaire en ligne, et chaque bloc inline porte bien le
nonce de sa propre reponse. Syntaxe JavaScript de chaque gabarit verifiee
par node --check.
193 tests. Le dernier xfail de SEC-WEB-001 reussissait, le marqueur est
retire. Il n'en reste qu'un : SEC-AUTH-006, enumeration de comptes.
style-src conserve 'unsafe-inline' : les attributs style="" sont partout et
ne sont pas un vecteur XSS a eux seuls. Migration distincte, non prioritaire.
Co-Authored-By: Claude Opus 5 <[email protected]>
184 lines
10 KiB
HTML
184 lines
10 KiB
HTML
{% extends "layouts/base.html" %}
|
|
{% block title %}Evaluate {{ player.username }} - TryoutPro{% endblock %}
|
|
{% block page_title %}Evaluate {{ player.username }}{% endblock %}
|
|
{% block breadcrumb %}<span class="breadcrumb">Home / <a href="{{ url_for('tryouts.view_tryout', tryout_id=tryout.id) }}">{{ tryout.title }}</a> / Evaluate</span>{% endblock %}
|
|
|
|
{% block content %}
|
|
<div class="dashboard-grid">
|
|
<div class="card">
|
|
<div class="card-header">
|
|
<h3><i class="fas fa-clipboard-list"></i> Player Evaluation</h3>
|
|
<span class="badge badge-info">{{ tryout.title }} - {{ tryout.game }}</span>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="eval-player-info mb-4">
|
|
<div class="user-avatar avatar-lg">{{ player.username[:2] | upper }}</div>
|
|
<div>
|
|
<h3>{{ player.username }}</h3>
|
|
<p class="text-muted">{{ player.email }} | {{ player.phone or 'No phone' }}</p>
|
|
</div>
|
|
</div>
|
|
|
|
{% if existing_eval %}
|
|
<div class="alert alert-info">
|
|
<i class="fas fa-info-circle"></i> You have already evaluated this player. Your previous scores are shown below.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<form method="POST" action="{{ url_for('evaluations.evaluate_player', tryout_id=tryout.id, player_id=player.id) }}" class="form">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
|
|
|
<div class="form-row">
|
|
<div class="form-group col-4">
|
|
<label for="mecanics_score">Mecanics (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="mecanics_score" name="mecanics_score" min="1" max="10" value="{{ existing_eval.mecanics_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.mecanics_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="cohesion_score">Cohesion (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="cohesion_score" name="cohesion_score" min="1" max="10" value="{{ existing_eval.cohesion_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.cohesion_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="communication_score">Communication (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="communication_score" name="communication_score" min="1" max="10" value="{{ existing_eval.communication_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.communication_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-row">
|
|
<div class="form-group col-4">
|
|
<label for="gamesense_score">Gamesense (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="gamesense_score" name="gamesense_score" min="1" max="10" value="{{ existing_eval.gamesense_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.gamesense_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="versatility_score">Versatility (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="versatility_score" name="versatility_score" min="1" max="10" value="{{ existing_eval.versatility_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.versatility_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="discipline_score">Discipline (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="discipline_score" name="discipline_score" min="1" max="10" value="{{ existing_eval.discipline_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.discipline_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-row">
|
|
<div class="form-group col-4">
|
|
<label for="analysis_score">Analysis (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="analysis_score" name="analysis_score" min="1" max="10" value="{{ existing_eval.analysis_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.analysis_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="sport_ethics_score">Sport Ethics (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="sport_ethics_score" name="sport_ethics_score" min="1" max="10" value="{{ existing_eval.sport_ethics_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.sport_ethics_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="form-group col-4">
|
|
<label for="mental_score">Mental (1-10)</label>
|
|
<div class="score-input">
|
|
<input type="range" id="mental_score" name="mental_score" min="1" max="10" value="{{ existing_eval.mental_score or 5 }}" data-mirror>
|
|
<span class="range-value">{{ existing_eval.mental_score or 5 }}</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
{% set positions = game_positions.get(tryout.game, []) %}
|
|
<div class="form-row">
|
|
<div class="form-group col-12">
|
|
<label for="position_recommendation">Recommended Position</label>
|
|
{% if positions %}
|
|
<select id="position_recommendation" name="position_recommendation" class="form-select">
|
|
<option value="">-- Select Position --</option>
|
|
{% for pos in positions %}
|
|
<option value="{{ pos }}" {% if existing_eval.position_recommendation == pos %}selected{% endif %}>{{ pos }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
{% else %}
|
|
<input type="text" id="position_recommendation" name="position_recommendation" value="{{ existing_eval.position_recommendation or '' }}" placeholder="Enter position (optional)">
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="comments">Comments</label>
|
|
<textarea id="comments" name="comments" rows="4" placeholder="Enter your evaluation notes...">{{ existing_eval.comments or '' }}</textarea>
|
|
</div>
|
|
|
|
<div class="form-actions">
|
|
<a href="{{ url_for('tryouts.view_tryout', tryout_id=tryout.id) }}" class="btn btn-secondary">Cancel</a>
|
|
<button type="submit" class="btn btn-primary">
|
|
<i class="fas fa-save"></i> {% if existing_eval %}Update Evaluation{% else %}Submit Evaluation{% endif %}
|
|
</button>
|
|
<a href="{{ url_for('users.notes_dashboard') }}" class="btn btn-outline" title="Add note for this player">
|
|
<i class="fas fa-sticky-note"></i> Add Note
|
|
</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
|
|
{% if evaluators %}
|
|
<div class="card">
|
|
<div class="card-header">
|
|
<h3><i class="fas fa-users"></i> All Evaluations for {{ player.username }}</h3>
|
|
</div>
|
|
<div class="card-body">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Evaluator</th>
|
|
<th>Mecanics</th>
|
|
<th>Cohesion</th>
|
|
<th>Communication</th>
|
|
<th>Gamesense</th>
|
|
<th>Versatility</th>
|
|
<th>Discipline</th>
|
|
<th>Analysis</th>
|
|
<th>Sport Ethics</th>
|
|
<th>Mental</th>
|
|
<th>Overall</th>
|
|
<th>Position</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for entry in evaluators %}
|
|
<tr>
|
|
<td>{{ entry.evaluator.username }}</td>
|
|
<td>{{ entry.eval.mecanics_score or '-' }}</td>
|
|
<td>{{ entry.eval.cohesion_score or '-' }}</td>
|
|
<td>{{ entry.eval.communication_score or '-' }}</td>
|
|
<td>{{ entry.eval.gamesense_score or '-' }}</td>
|
|
<td>{{ entry.eval.versatility_score or '-' }}</td>
|
|
<td>{{ entry.eval.discipline_score or '-' }}</td>
|
|
<td>{{ entry.eval.analysis_score or '-' }}</td>
|
|
<td>{{ entry.eval.sport_ethics_score or '-' }}</td>
|
|
<td>{{ entry.eval.mental_score or '-' }}</td>
|
|
<td><span class="score">{{ entry.eval.overall_score or '-' }}</span></td>
|
|
<td>{{ entry.eval.position_recommendation or '-' }}</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
{% endblock %} |