bvandeusenandClaude Opus 5.5
f47fc23265
#5099 "A name containing a quote runs script when an admin clicks Delete". Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a name such as x');fetch(…);// from running. - Every prompt (22 handlers, plus the docker prune and token revoke ones) is now data-confirm="…", read through dataset by one submit listener in base.html; nothing rendered is parsed as JavaScript. - The remaining inline handlers take integers only (|int), and the time range buttons pass this.dataset.range. - tests/test_inline_handlers.py fails on any {{ }} in an inline handler that is not |int, with a self-test; tests/_templates.py is the one template walker the template guards now share. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
99 lines
4.7 KiB
HTML
99 lines
4.7 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Browse Playbooks — Steward{% endblock %}
|
|
{% block breadcrumb %}
|
|
{%- if view_contents is defined -%}
|
|
{{ crumbs([("Ansible", "/ansible/"), ("Browse", "/ansible/browse"), (view_path, "")]) }}
|
|
{%- else -%}
|
|
{{ crumbs([("Ansible", "/ansible/"), ("Browse", "")]) }}
|
|
{%- endif -%}
|
|
{% endblock %}
|
|
{% block content %}
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Browse Playbooks</h1>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
{% if session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/new" class="btn btn-sm">New playbook</a>
|
|
{% endif %}
|
|
<a href="/ansible/inventory/targets" class="btn btn-ghost btn-sm">Inventory</a>
|
|
<a href="/ansible/schedules" class="btn btn-ghost btn-sm">Schedules</a>
|
|
</div>
|
|
</div>
|
|
|
|
{% if view_contents is defined %}
|
|
<div class="card">
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1rem;">
|
|
<h3 class="section-title">{{ view_path }}</h3>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
{% if view_editable and session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/edit/{{ view_source }}/{{ view_path }}" class="btn btn-sm">Edit</a>
|
|
<form method="post" action="/ansible/playbooks/delete" style="display:inline;"
|
|
data-confirm="Delete {{ view_path }}?">{{ csrf_field() }}
|
|
<input type="hidden" name="source_name" value="{{ view_source }}">
|
|
<input type="hidden" name="playbook_path" value="{{ view_path }}">
|
|
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
<pre style="background:var(--bg);padding:1rem;border-radius:4px;overflow-x:auto;font-size:0.8rem;color:var(--text-muted);max-height:600px;overflow-y:auto;">{{ view_contents }}</pre>
|
|
</div>
|
|
{% endif %}
|
|
|
|
{% if not source_data %}
|
|
{% if view_contents is not defined %}
|
|
<div class="card">
|
|
<p style="color:var(--text-muted);">No Ansible sources configured. <a href="/settings/ansible/">Add sources in Settings → Ansible</a>.</p>
|
|
</div>
|
|
{% endif %}
|
|
{% else %}
|
|
{% for sd in source_data %}
|
|
<div class="card" style="margin-bottom:1.5rem;">
|
|
<div style="display:flex;align-items:center;gap:0.75rem;margin-bottom:1rem;">
|
|
<h3 class="section-title">{{ sd.source.name }}</h3>
|
|
<span style="color:var(--text-muted);font-size:0.8rem;background:var(--bg-elevated);padding:0.2rem 0.5rem;border-radius:3px;">{{ sd.source.type }}</span>
|
|
<span style="color:var(--text-dim);font-size:0.8rem;">{{ sd.source.path }}</span>
|
|
</div>
|
|
|
|
{% if not sd.playbooks %}
|
|
<p style="color:var(--text-dim);font-size:0.9rem;">No playbooks found at this path.</p>
|
|
{% else %}
|
|
<table class="table" style="margin-bottom:1rem;">
|
|
<thead>
|
|
<tr>
|
|
<th>Playbook</th>
|
|
<th style="width:120px;"></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for pb in sd.playbooks %}
|
|
<tr>
|
|
<td>
|
|
<div style="display:flex;align-items:center;gap:0.5rem;flex-wrap:wrap;">
|
|
{% if pb.category %}<span style="font-size:0.68rem;text-transform:uppercase;letter-spacing:0.04em;background:var(--bg-elevated);color:var(--text-dim);border-radius:3px;padding:0.05em 0.45em;">{{ pb.category }}</span>{% endif %}
|
|
<span style="font-family:ui-monospace,monospace;font-size:0.88rem;">{{ pb.path }}</span>
|
|
</div>
|
|
{% if pb.description %}<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.15rem;">{{ pb.description }}</div>{% endif %}
|
|
</td>
|
|
<td class="td-actions">
|
|
<a href="/ansible/browse/{{ sd.source.name }}/{{ pb.path }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">View</a>
|
|
{% if sd.editable and session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/edit/{{ sd.source.name }}/{{ pb.path }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
|
|
{% endif %}
|
|
<a hx-get="/ansible/run-form/{{ sd.source.name }}/{{ pb.path }}"
|
|
hx-target="#run-form-{{ sd.source.name }}" hx-swap="innerHTML"
|
|
style="cursor:pointer;" class="btn btn-sm btn-ghost">Run</a>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
|
|
{# Run form (loaded on demand via HTMX from /ansible/run-form/<source>/<pb>) #}
|
|
<div id="run-form-{{ sd.source.name }}"></div>
|
|
{% endif %}
|
|
</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endblock %}
|