bvandeusenandClaude Opus 5.5
f47fc23265
#5099 "A name containing a quote runs script when an admin clicks Delete". Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a name such as x');fetch(…);// from running. - Every prompt (22 handlers, plus the docker prune and token revoke ones) is now data-confirm="…", read through dataset by one submit listener in base.html; nothing rendered is parsed as JavaScript. - The remaining inline handlers take integers only (|int), and the time range buttons pass this.dataset.range. - tests/test_inline_handlers.py fails on any {{ }} in an inline handler that is not |int, with a self-test; tests/_templates.py is the one template walker the template guards now share. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
669 B
HTML
16 lines
669 B
HTML
{#
|
|
Reusable time-range selector.
|
|
Requires `current_range` to be in template context.
|
|
Places a hidden input #time-range (name="range") that HTMX hx-include picks up,
|
|
plus a visible button group that calls setTimeRange() defined in base.html.
|
|
#}
|
|
<div style="display:flex;align-items:center;gap:0.2rem;">
|
|
<input type="hidden" id="time-range" name="range" value="{{ current_range }}">
|
|
{% for key in ["1h", "6h", "24h", "7d", "30d"] %}
|
|
<button type="button"
|
|
class="range-btn{% if current_range == key %} active{% endif %}"
|
|
data-range="{{ key }}"
|
|
onclick="setTimeRange(this.dataset.range)">{{ key }}</button>
|
|
{% endfor %}
|
|
</div>
|