bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
2.3 KiB
HTML
50 lines
2.3 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% from "monitors/_fields.html" import type_fields, toggle_script %}
|
|
{% block title %}Edit Monitor — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Monitors", "/monitors/"), ("Edit monitor", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
<div style="margin-bottom:1.25rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Edit Monitor</h1>
|
|
</div>
|
|
|
|
{% set inp = "width:100%;padding:0.4rem 0.65rem;background:var(--bg);border:1px solid var(--border-mid);border-radius:4px;color:var(--text);font-size:0.88rem;" %}
|
|
{% set lbl = "font-size:0.75rem;color:var(--text-muted);display:block;margin-bottom:0.2rem;" %}
|
|
|
|
<div class="card" style="max-width:760px;">
|
|
<form method="post" action="/monitors/{{ monitor.id }}/edit" style="display:grid;gap:0.6rem;">{{ csrf_field() }}
|
|
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(160px,1fr));gap:0.6rem;align-items:end;">
|
|
<div>
|
|
<label style="{{ lbl }}">Type</label>
|
|
<input type="text" value="{{ monitor.type | upper }}" disabled style="{{ inp }}opacity:0.7;">
|
|
</div>
|
|
<div>
|
|
<label style="{{ lbl }}">Name</label>
|
|
<input type="text" name="name" value="{{ monitor.name }}" autocomplete="off" style="{{ inp }}">
|
|
</div>
|
|
<div>
|
|
<label style="{{ lbl }}">Target <span style="color:var(--red);">*</span></label>
|
|
<input type="text" name="target" value="{{ monitor.target }}" autocomplete="off" required style="{{ inp }}">
|
|
</div>
|
|
<div>
|
|
<label style="{{ lbl }}">Interval (s, 0=global)</label>
|
|
<input type="number" name="check_interval_seconds" value="{{ monitor.check_interval_seconds }}" min="0" style="{{ inp }}">
|
|
</div>
|
|
{{ type_fields(config) }}
|
|
</div>
|
|
{% if monitor.host_id %}
|
|
<p style="font-size:0.78rem;color:var(--text-dim);margin:0;">
|
|
Linked to <a href="/hosts/{{ monitor.host_id }}" style="color:var(--accent);">its host</a>.
|
|
</p>
|
|
{% endif %}
|
|
<div style="display:flex;gap:0.5rem;">
|
|
<button type="submit" class="btn btn-sm">Save</button>
|
|
<a href="/monitors/" class="btn btn-sm" style="background:transparent;border:1px solid var(--border-mid);">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
|
|
{{ toggle_script() }}
|
|
<script>mtoggle({{ monitor.type | tojson }});</script>
|
|
{% endblock %}
|