bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
4.3 KiB
HTML
79 lines
4.3 KiB
HTML
{# Bottom drawer — the widget picker, revealed by body.dash-editing. Fixed-position
|
|
overlay so it never changes the dashboard's width. Add forms are submitted via
|
|
JS (see index.html) which inserts the returned grid item in place. #}
|
|
<div class="widget-drawer" id="widget-drawer" aria-label="Add a widget">
|
|
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:0.75rem;
|
|
position:sticky;top:0;background:var(--bg-card);padding-bottom:0.5rem;">
|
|
<div class="section-title" style="margin-bottom:0;">Add a widget</div>
|
|
<button type="button" class="btn btn-sm" id="dash-edit-done">Done</button>
|
|
</div>
|
|
{% if addable %}
|
|
{% set _groups = [("core", "Core monitors"), ("capability", "Monitoring capabilities"), ("integration", "Integrations")] %}
|
|
{% for _gkey, _glabel in _groups %}
|
|
{% set _gw = addable | selectattr("group", "equalto", _gkey) | list %}
|
|
{% if _gw %}
|
|
<div style="font-size:0.72rem;text-transform:uppercase;letter-spacing:0.04em;color:var(--text-dim);margin:0.6rem 0 0.35rem;">{{ _glabel }}</div>
|
|
<div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:0.5rem;">
|
|
{% for w in _gw %}
|
|
<div class="card" style="margin-bottom:0;padding:0;overflow:hidden;">
|
|
<details>
|
|
<summary style="display:flex;align-items:center;justify-content:space-between;gap:0.6rem;
|
|
padding:0.7rem 0.85rem;cursor:pointer;list-style:none;user-select:none;">
|
|
<div style="flex:1;min-width:0;">
|
|
<div style="font-weight:600;font-size:0.85rem;">{{ w.label }}</div>
|
|
<div style="font-size:0.74rem;color:var(--text-muted);margin-top:0.1rem;">{{ w.description }}</div>
|
|
</div>
|
|
<span class="btn btn-sm" style="flex-shrink:0;pointer-events:none;">Add ▾</span>
|
|
</summary>
|
|
<form action="/d/{{ dashboard.id }}/edit/add/{{ w.key }}" method="post"
|
|
class="add-widget-form"
|
|
style="padding:0.75rem 0.85rem;padding-top:0;border-top:1px solid var(--border);">{{ csrf_field() }}
|
|
<div style="display:grid;gap:0.5rem;padding-top:0.75rem;">
|
|
<div>
|
|
<label style="font-size:0.74rem;color:var(--text-muted);display:block;margin-bottom:0.2rem;">
|
|
Widget title <span style="color:var(--text-dim);">(optional)</span>
|
|
</label>
|
|
<input type="text" name="title" placeholder="{{ w.label }}"
|
|
style="width:100%;padding:0.32rem 0.6rem;background:var(--bg);
|
|
border:1px solid var(--border-mid);border-radius:4px;
|
|
color:var(--text);font-size:0.85rem;">
|
|
</div>
|
|
{% for p in w.params %}
|
|
<div>
|
|
<label style="font-size:0.74rem;color:var(--text-muted);display:block;margin-bottom:0.2rem;">{{ p.label }}</label>
|
|
{% if p.type == "select" %}
|
|
<select name="param_{{ p.key }}"
|
|
style="width:100%;padding:0.32rem 0.6rem;background:var(--bg);
|
|
border:1px solid var(--border-mid);border-radius:4px;color:var(--text);font-size:0.85rem;">
|
|
{% for opt in p.options %}
|
|
<option value="{{ opt.value }}" {% if opt.value == p.default %}selected{% endif %}>{{ opt.label }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
{% elif p.type == "host" %}
|
|
<select name="param_{{ p.key }}" required
|
|
style="width:100%;padding:0.32rem 0.6rem;background:var(--bg);
|
|
border:1px solid var(--border-mid);border-radius:4px;color:var(--text);font-size:0.85rem;">
|
|
<option value="">— select a host —</option>
|
|
{% for h in hosts %}
|
|
<option value="{{ h.id }}">{{ h.name }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
{% endif %}
|
|
</div>
|
|
{% endfor %}
|
|
<button type="submit" class="btn btn-sm" style="width:100%;margin-top:0.1rem;">Add to dashboard</button>
|
|
</div>
|
|
</form>
|
|
</details>
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% else %}
|
|
<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">
|
|
No plugin widgets available. Enable plugins in Settings → Plugins.
|
|
</div>
|
|
{% endif %}
|
|
</div>
|