source: Klonkt/src/views/pages/admin-newsletter.ejs@ f7d142f

main
Last change on this file since f7d142f was f7d142f, checked in by Robin Genis <roboburr@…>, 2 months ago

chore(csp): drop the last script unsafe-inline + add Permissions-Policy

Move every inline on* handler to a shared delegated data-* handler, so script-src-attr
can be 'none' instead of 'unsafe-inline'. Add a Permissions-Policy header disabling
camera/microphone/geolocation/Topics (embed features left at default).

  • views/shell.ejs — shared delegated submit/change/click/error handler (data-confirm, data-autosubmit, data-lang-switch, data-selectall, data-back, data-fallback)
  • views/{pages,partials}/*.ejs — 18 inline on* handlers -> data-* attributes (14 files)
  • server.js — scriptSrcAttr 'unsafe-inline' -> 'none'; Permissions-Policy header
  • Property mode set to 100644
File size: 4.2 KB
Line 
1<%
2 var c = (typeof nlCounts !== 'undefined') ? nlCounts : { confirmed:0, pending:0, unsub:0 };
3 var msg = (typeof nlMsg !== 'undefined') ? nlMsg : '';
4 var msgKind = (typeof nlMsgKind !== 'undefined') ? nlMsgKind : '';
5 var hist = (typeof nlHistory !== 'undefined') ? nlHistory : [];
6 var smtp = (typeof nlSmtp !== 'undefined') ? nlSmtp : false;
7%>
8<section class="anl">
9 <h1><%= t('anews.title') %></h1>
10
11 <% if (msg) { %><div class="anl-msg anl-<%= msgKind %>"><%= msg %></div><% } %>
12
13 <div class="anl-stats">
14 <div class="anl-stat"><span class="anl-n"><%= c.confirmed %></span><span class="anl-l"><%= t('anews.confirmed') %></span></div>
15 <div class="anl-stat"><span class="anl-n"><%= c.pending %></span><span class="anl-l"><%= t('anews.pending') %></span></div>
16 <div class="anl-stat"><span class="anl-n"><%= c.unsub %></span><span class="anl-l"><%= t('anews.unsub') %></span></div>
17 </div>
18
19 <% if (!smtp) { %>
20 <div class="anl-msg anl-warn"><%= t('anews.smtp_warn_1') %> (<code>SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASS / SMTP_FROM</code> <%= t('anews.smtp_warn_2') %> <code>.env</code>).</div>
21 <% } %>
22
23 <p class="anl-share"><%= t('anews.share') %> <a href="<%= nlSubscribeUrl %>"><%= nlSubscribeUrl %></a></p>
24
25 <% var _sendConfirm = t('anews.send_confirm', { n: c.confirmed }); %>
26 <form method="POST" action="<%= siteUrlBase %>/admin/newsletter/send" class="anl-form" data-confirm="<%= _sendConfirm %>">
27 <label><%= t('anews.subject') %>
28 <input type="text" name="subject" required maxlength="200" value="<%= (typeof nlSubject!=='undefined')?nlSubject:'' %>" placeholder="<%= t('anews.subject_ph') %>">
29 </label>
30 <label><%= t('anews.body') %>
31 <textarea name="body" rows="10" required placeholder="<%= t('anews.body_ph') %>"><%= (typeof nlBody!=='undefined')?nlBody:'' %></textarea>
32 </label>
33 <button type="submit" class="anl-send" <%= smtp ? '' : 'disabled' %>><%= t('anews.send_btn', { n: c.confirmed }) %></button>
34 </form>
35
36 <% if (hist.length) { %>
37 <h2 class="anl-h2"><%= t('anews.sent_heading') %></h2>
38 <% var _recipients = t('anews.recipients'); %>
39 <ul class="anl-hist">
40 <% hist.forEach(function(h){ %>
41 <li><span class="anl-hist-subj"><%= h.subject %></span><span class="anl-hist-meta"><%= h.recipient_count %> <%= _recipients %> · <%= formatDateTime ? formatDateTime(h.sent_at) : h.sent_at %></span></li>
42 <% }); %>
43 </ul>
44 <% } %>
45</section>
46
47<style>
48 .anl { max-width: 720px; margin: 0 auto; padding: 24px 18px 64px; }
49 .anl h1 { margin: 0 0 18px; }
50 .anl-msg { padding: 11px 14px; border-radius: 10px; margin-bottom: 16px; font-size: 14px; }
51 .anl-ok { background: rgba(60,160,90,.15); }
52 .anl-bad { background: rgba(200,60,60,.15); }
53 .anl-warn { background: rgba(210,160,40,.15); }
54 .anl-stats { display: flex; gap: 12px; margin-bottom: 18px; flex-wrap: wrap; }
55 .anl-stat { flex: 1 1 100px; border: 1px solid rgba(128,128,128,.2); border-radius: 12px; padding: 14px; text-align: center; }
56 .anl-n { display: block; font-size: 28px; font-weight: 700; }
57 .anl-l { font-size: 12px; opacity: .65; text-transform: uppercase; letter-spacing: .06em; }
58 .anl-share { font-size: 13px; opacity: .8; margin: 0 0 20px; }
59 .anl-form { display: flex; flex-direction: column; gap: 14px; }
60 .anl-form label { display: flex; flex-direction: column; gap: 6px; font-weight: 600; font-size: 13.5px; }
61 .anl-form input, .anl-form textarea { padding: 11px 13px; border-radius: 10px; border: 1px solid rgba(128,128,128,.4); background: transparent; color: inherit; font: inherit; font-weight: 400; }
62 .anl-send { align-self: flex-start; padding: 11px 20px; border-radius: 10px; border: none; background: var(--accent, #6b8f71); color: #fff; font-weight: 600; cursor: pointer; }
63 .anl-send:disabled { opacity: .5; cursor: not-allowed; }
64 .anl-h2 { margin: 30px 0 12px; font-size: 13px; text-transform: uppercase; letter-spacing: .08em; opacity: .6; }
65 .anl-hist { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 8px; }
66 .anl-hist li { display: flex; justify-content: space-between; gap: 12px; padding: 10px 12px; border: 1px solid rgba(128,128,128,.18); border-radius: 10px; flex-wrap: wrap; }
67 .anl-hist-meta { opacity: .6; font-size: 12.5px; }
68</style>
Note: See TracBrowser for help on using the repository browser.