bvandeusenandClaude Opus 5.5
f47fc23265
#5099 "A name containing a quote runs script when an admin clicks Delete". Inline handlers like onclick="return confirm('Delete {{ rule.name }}?')" are HTML-decoded before the JavaScript is parsed, so autoescaping did not stop a name such as x');fetch(…);// from running. - Every prompt (22 handlers, plus the docker prune and token revoke ones) is now data-confirm="…", read through dataset by one submit listener in base.html; nothing rendered is parsed as JavaScript. - The remaining inline handlers take integers only (|int), and the time range buttons pass this.dataset.range. - tests/test_inline_handlers.py fails on any {{ }} in an inline handler that is not |int, with a self-test; tests/_templates.py is the one template walker the template guards now share. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
3.0 KiB
HTML
79 lines
3.0 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Maintenance Windows — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Alerts", "/alerts/"), ("Maintenance", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Maintenance Windows</h1>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
<a class="btn" href="/alerts/maintenance/new">New Window</a>
|
|
</div>
|
|
</div>
|
|
|
|
<p style="color:var(--text-muted);font-size:0.88rem;margin-bottom:1.5rem;">
|
|
During an active window, alerts in its scope still change state and show on the Alerts page,
|
|
but send no notifications and run no Ansible actions. Each event a window mutes says so in
|
|
the alert's history. An alert that is still firing when the window ends notifies then, and runs its action.
|
|
</p>
|
|
|
|
{% if windows %}
|
|
<div class="card-flush">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Scope</th>
|
|
<th>Start</th>
|
|
<th>End</th>
|
|
<th style="text-align:center;">Status</th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for w in windows %}
|
|
{% set is_active = w.start_at <= now and w.end_at >= now %}
|
|
{% set is_upcoming = w.start_at > now %}
|
|
<tr>
|
|
<td style="font-weight:500;">{{ w.name }}</td>
|
|
<td style="font-size:0.85rem;color:var(--text-muted);">
|
|
{% if w.scope_source is none %}
|
|
<span title="All alert rules">All alerts</span>
|
|
{% elif w.scope_resource is none %}
|
|
<span>{{ w.scope_source }}/*</span>
|
|
{% else %}
|
|
<span>{{ w.scope_source }}/{{ w.scope_resource }}</span>
|
|
{% endif %}
|
|
</td>
|
|
<td style="font-size:0.85rem;font-family:ui-monospace,monospace;">
|
|
{{ w.start_at.strftime("%Y-%m-%d %H:%M") }} UTC
|
|
</td>
|
|
<td style="font-size:0.85rem;font-family:ui-monospace,monospace;">
|
|
{{ w.end_at.strftime("%Y-%m-%d %H:%M") }} UTC
|
|
</td>
|
|
<td style="text-align:center;">
|
|
{% if is_active %}
|
|
<span class="badge badge-yellow">active</span>
|
|
{% elif is_upcoming %}
|
|
<span class="badge badge-dim">upcoming</span>
|
|
{% else %}
|
|
<span style="color:var(--text-dim);font-size:0.8rem;">expired</span>
|
|
{% endif %}
|
|
</td>
|
|
<td class="td-actions">
|
|
<form method="post" action="/alerts/maintenance/{{ w.id }}/delete" style="display:inline;">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-sm btn-danger"
|
|
data-confirm="Delete window "{{ w.name }}"?">Delete</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% else %}
|
|
<div class="card" style="text-align:center;padding:3rem;">
|
|
<p style="color:var(--text-muted);">No maintenance windows configured.</p>
|
|
</div>
|
|
{% endif %}
|
|
{% endblock %}
|