bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
77 lines
3.4 KiB
HTML
77 lines
3.4 KiB
HTML
{# steward/templates/settings/notifications.html #}
|
|
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Settings — Notifications — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Notifications", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
{% set active_tab = "notifications" %}
|
|
{% include "settings/_tabs.html" %}
|
|
|
|
<form method="post" action="/settings/notifications/">{{ csrf_field() }}
|
|
<div style="display:grid;gap:1.25rem;max-width:640px;">
|
|
|
|
{# ── SMTP ──────────────────────────────────────────────────────────────── #}
|
|
<div class="card">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">Email (SMTP)</h2>
|
|
|
|
<div class="form-group">
|
|
<label>SMTP host</label>
|
|
<input type="text" name="smtp.host" value="{{ settings['smtp.host'] }}"
|
|
placeholder="mail.example.com">
|
|
</div>
|
|
|
|
<div style="display:grid;grid-template-columns:1fr 1fr;gap:1rem;">
|
|
<div class="form-group">
|
|
<label>Port</label>
|
|
<input type="number" name="smtp.port" value="{{ settings['smtp.port'] }}">
|
|
</div>
|
|
<div class="form-group" style="display:flex;align-items:center;gap:0.5rem;padding-top:1.5rem;">
|
|
<input type="checkbox" name="smtp.tls" id="smtp-tls"
|
|
{% if settings['smtp.tls'] %}checked{% endif %}>
|
|
<label for="smtp-tls" style="margin:0;">Use TLS</label>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Username</label>
|
|
<input type="text" name="smtp.username" value="{{ settings['smtp.username'] }}"
|
|
autocomplete="off">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Password <span style="color:var(--text-muted);font-size:0.8rem;">(leave blank to keep current)</span></label>
|
|
<input type="password" name="smtp.password" placeholder="••••••••" autocomplete="new-password">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Recipients <span style="color:var(--text-muted);font-size:0.8rem;">(comma-separated)</span></label>
|
|
<input type="text" name="smtp.recipients"
|
|
value="{{ settings['smtp.recipients'] | join(', ') }}"
|
|
placeholder="admin@example.com, ops@example.com">
|
|
</div>
|
|
</div>
|
|
|
|
{# ── Webhook ───────────────────────────────────────────────────────────── #}
|
|
<div class="card">
|
|
<h2 class="section-title" style="margin-bottom:1.25rem;">Webhook</h2>
|
|
|
|
<div class="form-group">
|
|
<label>URL <span style="color:var(--text-muted);font-size:0.8rem;">(leave blank to disable)</span></label>
|
|
<input type="text" name="webhook.url" value="{{ settings['webhook.url'] }}"
|
|
placeholder="https://discord.com/api/webhooks/...">
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label>Payload template <span style="color:var(--text-muted);font-size:0.8rem;">(Jinja2, must produce valid JSON)</span></label>
|
|
<textarea name="webhook.template" rows="4"
|
|
style="font-family:ui-monospace,monospace;font-size:0.85rem;">{{ settings['webhook.template'] }}</textarea>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<div style="margin-top:1rem;">
|
|
<button type="submit" class="btn">Save</button>
|
|
</div>
|
|
</form>
|
|
{% endblock %}
|