Changeset f7d142f in Klonkt for src/views/partials

Timestamp:

06/28/2026 03:36:22 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

81bb9c5

Parents:

127f87e

Message:

chore(csp): drop the last script unsafe-inline + add Permissions-Policy

Move every inline on* handler to a shared delegated data-* handler, so script-src-attr
can be 'none' instead of 'unsafe-inline'. Add a Permissions-Policy header disabling
camera/microphone/geolocation/Topics (embed features left at default).

• views/shell.ejs — shared delegated submit/change/click/error handler (data-confirm, data-autosubmit, data-lang-switch, data-selectall, data-back, data-fallback)
• views/{pages,partials}/*.ejs — 18 inline on* handlers -> data-* attributes (14 files)
• server.js — scriptSrcAttr 'unsafe-inline' -> 'none'; Permissions-Policy header

Location:

src/views/partials

Files:

• fedi-node.ejs (modified) (1 diff)
• footer.ejs (modified) (1 diff)
• playlist-editor.ejs (modified) (1 diff)

src/views/partials/fedi-node.ejs

@@ -14 +14 @@
   <div class="comment-actions">
     <% if (n.mine && typeof canManageSite !== 'undefined' && canManageSite && n.outboxId) { %>
-      <form method="post" action="<%= _base %>/fediverse/<%= n.outboxId %>/delete" onsubmit="return confirm('<%= t('fedi.delete_confirm') %>')">
+      <form method="post" action="<%= _base %>/fediverse/<%= n.outboxId %>/delete" data-confirm="<%= t('fedi.delete_confirm') %>">
         <button type="submit" class="comment-delete-btn"><%= t('comments.delete') %></button>
       </form>

src/views/partials/footer.ejs

@@ -22 +22 @@
       <% if (typeof langs !== 'undefined' && langs && langs.length > 1) { %>
         <select class="footer-lang" aria-label="<%= t('nav.language') %>"
-                onchange="location.href='/lang/'+this.value+'?r='+encodeURIComponent(location.pathname+location.search)">
+                data-lang-switch>
           <% langs.forEach(function(l){ %><option value="<%= l.code %>"<%= l.active ? ' selected' : '' %>><%= l.name %></option><% }); %>
         </select>

src/views/partials/playlist-editor.ejs

@@ -442 +442 @@
       const u = coverEl.value.trim();
       coverThumb.innerHTML = u
-        ? `<img src="${esc(u)}" alt="" onerror="this.parentElement.innerHTML='<span class=\\'pl-cover-empty\\'>⚠️</span>'">`
+        ? `<img src="${esc(u)}" alt="" data-fallback>`
         : `<span class="pl-cover-empty">🎨</span>`;
     });