Skip to content

Commit d6eb7f7

Browse files
sstriglersstrigler
committed
fix: no inline scripts
1 parent 82146f3 commit d6eb7f7

File tree

9 files changed

+57
-83
lines changed

9 files changed

+57
-83
lines changed

‎priv/mod_invites/base.html‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ <h1 class="modal-title h5">{% trans "Scan invite code" %}</h1>
2424
<p>{% trans "You can transfer this invite to your mobile device by scanning a code with your camera." %}</p>
2525
<div id="qr-info-url" class="tab-pane show active">
2626
<p>{% trans "Use a <em>QR code</em> scanner on your mobile device to scan the code below:" %}</p>
27-
<div id="qr-invite-page" style="width: 256px;" class="bg-light mx-auto"></div>
27+
<div id="qr-invite-page" class="bg-light mx-auto"></div>
2828
</div>
2929
</div>
3030
<div class="modal-footer">
@@ -38,5 +38,4 @@ <h1 class="modal-title h5">{% trans "Scan invite code" %}</h1>
3838
{% block extra_scripts %}
3939
<script src="{{ static }}/qrcode.min.js" integrity="sha384-XfbBihCQqSDyejklP5yun2CbVxqR+2eNfx0Fhx5pQAfN5ypWGhSBjXaXr5g6X4DE"></script>
4040
<script src="{{ static }}/platform.min.js" integrity="sha384-nziKWRrD67nso9WErLVLhgT7AobHh6aYfNgqgINmJrtZ92V9aNTaOpvDFkcneToL"></script>
41-
<script src="{{ static }}/invite.js" integrity="sha384-Gbay/kHKBWDl+ujPP2IvgkW1k0EEtCABOs5sZbovcjLyHZm0lumFMOIdTsWRxBLy"></script>
4241
{% endblock %}

‎priv/mod_invites/base_min.html‎

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,28 +13,7 @@
1313
<!-- <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"> -->
1414
<meta name="msapplication-TileColor" content="#fbd308">
1515
<meta name="theme-color" content="#fbd308">
16-
<style>
17-
#other-software a {
18-
text-decoration: underline;
19-
color: #0072ed;
20-
}
21-
a#show-all-clients-button {
22-
text-decoration: underline;
23-
}
24-
.btn-primary {
25-
background-color: #0072ed;
26-
}
27-
.badge-success {
28-
background-color: #0a8927;
29-
}
30-
.alert-info, .alert-info a, .btn-info {
31-
background-color: #008297;
32-
color: white;
33-
}
34-
.border-info {
35-
border-color: #008297 !important;
36-
}
37-
</style>
16+
<link rel="stylesheet" href="{{ static }}/invite.css" integrity="sha384-hN1sIlm8uxqtq9Q4lhN1KW+O4HHk7Iwu+8ZT5QOZ4NU65xAXc99wTMJQ729MgOBJ">
3817
</head>
3918
<body>
4019
<div id="background" class="fixed-top overflow-hidden"></div>
@@ -51,5 +30,6 @@ <h1 class="card-header">{%block h1 %}{% blocktrans %}Invite to {{ site_name }}{%
5130
{% block extra_scripts %}{% endblock %}
5231
<script src="{{ static }}/jquery/jquery.min.js" integrity="sha384-fgGyf7Mo7DURSOMnOy7ed+dkq5Job205Gnzu6QIg0BOHKaqt4D76Dt8VlDCzcMHV"></script>
5332
<script src="{{ static }}/bootstrap/js/bootstrap.min.js" integrity="sha384-G/EV+4j2dNv+tEPo3++6LCgdCROaejBqfUeNjuKAiuXbjrxilcCdDz6ZAVfHWe1Y"></script>
33+
<script src="{{ static }}/invite.js" integrity="sha384-9bnOkvcVOIB80uiyxcvD716620R5Ry6+Xw48IrjCIXL6dMhbHv5v35tawQ4YfV+6"></script>
5434
</body>
5535
</html>

‎priv/mod_invites/client.html‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ <h3 class="card-title text-nowrap mb-1 h5">{{ app.name }}</h3>
2828
</div>
2929
</div>
3030

31-
<h2 style="clear:both" class="h3">{% blocktrans with app_name=app.name %}Step 1: Install {{ app_name }}{% endblocktrans %}</h2>
31+
<h2 class="h3 clear-both">{% blocktrans with app_name=app.name %}Step 1: Install {{ app_name }}{% endblocktrans %}</h2>
3232

3333
<p>{% if app.download.text %}{{ app.download.text }}{% else %}{% blocktrans with app_name=app.name %}Download and install {{ app_name }} below:{% endblocktrans %}{% endif %}</p>
3434

3535
<div class="ms-5">
3636
{% for button in app.download.buttons %}
3737
{% if button.image %}
3838
<a href="{% if button.magic_link %}{{ button.magic_link }}{% else %}{{ button.url }}{% endif %}" {% if button.target %}target="{{ button.target }}"{% endif %} rel="noopener">
39-
<img src="{{ button.image }}" {% if button.alttext %}alt="{{ button.alttext }}"{% endif %} style="max-width: 160px;">
39+
<img src="{{ button.image }}" {% if button.alttext %}alt="{{ button.alttext }}"{% endif %} class="invite-download-button">
4040
</a>
4141
{% endif %}
4242
{% if button.text %}
@@ -68,9 +68,3 @@ <h2 class="h3">{% trans "Step 2: Activate your account" %}</h2>
6868
</nav>
6969

7070
{% endblock %}
71-
72-
{% block extra_scripts %}
73-
<script src="{{ static }}/qrcode.min.js"></script>
74-
<script src="{{ static }}/platform.min.js"></script>
75-
<script src="{{ static }}/invite.js"></script>
76-
{% endblock %}

‎priv/mod_invites/invite.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
{% else %}
77
{% blocktrans %}You have been invited to chat on <strong>{{ site_name }}</strong>, part of the XMPP secure and decentralized messaging network.{% endblocktrans %}
88
{% endif %}</p>
9-
<h2 class="card-title h5" style="clear:both">{% trans "Get started" %}</h2>
9+
<h2 class="card-title h5 clear-both">{% trans "Get started" %}</h2>
1010
<p>{% trans "To get started, you need to install an app for your platform:" %}</p>
1111

1212
{% include "apps.html" %}

‎priv/mod_invites/register.html‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -71,24 +71,3 @@ <h2 class="card-title h5">{% trans "Create an account" %}</h2>
7171
</ul>
7272
</nav>
7373
{% endblock %}
74-
{% block extra_scripts %}
75-
<script>
76-
(function() {
77-
'use strict';
78-
window.addEventListener('load', function() {
79-
// Fetch all the forms we want to apply custom Bootstrap validation styles to
80-
var forms = document.getElementsByClassName('needs-validation');
81-
// Loop over them and prevent submission
82-
var validation = Array.prototype.filter.call(forms, function(form) {
83-
form.addEventListener('submit', function(event) {
84-
if (form.checkValidity() === false) {
85-
event.preventDefault();
86-
event.stopPropagation();
87-
}
88-
form.classList.add('was-validated');
89-
}, false);
90-
});
91-
}, false);
92-
})();
93-
</script>
94-
{% endblock %}

‎priv/mod_invites/register_success.html‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,6 @@
22
{% block form_class %}container col-md-8 col-md-offset-2 col-sm-8 cold-sm-offset-2 col-lg-6 col-lg-offset-3 mt-2 mt-md-5{% endblock %}
33
{% block title %}{{site_name}}{% endblock %}
44
{% block h1 %}{{site_name}}{% endblock %}
5-
{% block extra_scripts %}
6-
<script>
7-
function toggle_password(e) {
8-
var button = e.target;
9-
var input = button.parentNode.parentNode.querySelector("input");
10-
switch(input.attributes.type.value) {
11-
case "password":
12-
input.attributes.type.value = "text";
13-
button.innerText = "{% trans "Hide" %}";
14-
break;
15-
case "text":
16-
input.attributes.type.value = "password";
17-
button.innerText = "{% trans "Show" %}";
18-
break;
19-
}
20-
}
21-
</script>
22-
{% endblock %}
235
{% block content %}
246
<h2 class="card-title h5">{% trans "Congratulations!" %}</h2>
257

@@ -87,7 +69,8 @@ <h2 class="h5">{% blocktrans with app_name=app.name %}Step 2: Connect {{ app_nam
8769
<div class="input-group">
8870
<input type="password" readonly disabled aria-label="{% trans "Password" %}" class="form-control" value="{{ password }}">
8971
<div class="input-group-append">
90-
<button class="btn btn-outline-secondary rounded-start-0" type="button" onclick="toggle_password(event)">{% trans "Show" %}</button>
72+
<button id="toggle-pw-button" class="btn btn-outline-secondary rounded-start-0" type="button"
73+
data-text-show="{% trans "Show" %}" data-text-hide="{% trans "Hide" %}">{% trans "Show" %}</button>
9174
</div>
9275
</div>
9376
</div>

‎priv/mod_invites/roster.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<a href="{{ invite.uri }}" class="btn btn-primary my-3 mb-3">{% blocktrans with inviter=invite.inviter|user %}Add {{ inviter }} to your contact list{% endblocktrans %}</a><br/>
1111
</div>
1212
</div>
13-
<h2 class="h6">{% trans "If you don't have an XMPP client installed yet, here's a list of suitable clients for your platform." %}</h2>
13+
<h2 class="h6 clear-both">{% trans "If you don't have an XMPP client installed yet, here's a list of suitable clients for your platform." %}</h2>
1414

1515
{% include "apps.html" %}
1616

‎priv/mod_invites/static/invite.js‎

Lines changed: 47 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -78,14 +78,53 @@
7878
}
7979
}
8080
const show_all_clients_button_container = document.getElementById('show-all-clients-button-container');
81-
show_all_clients_button_container.querySelector('.platform-name').innerHTML = platform_friendly;
82-
show_all_clients_button_container.classList.remove("d-none");
83-
document.getElementById('show-all-clients-button').addEventListener('click', function (e) {
84-
for (let card of client_cards)
85-
card.hidden = false;
86-
show_all_clients_button_container.hidden = true;
87-
e.preventDefault();
88-
});
81+
if (show_all_clients_button_container) {
82+
show_all_clients_button_container.querySelector('.platform-name').innerHTML = platform_friendly;
83+
show_all_clients_button_container.classList.remove("d-none");
84+
document.getElementById('show-all-clients-button').addEventListener('click', function (e) {
85+
for (let card of client_cards)
86+
card.hidden = false;
87+
show_all_clients_button_container.hidden = true;
88+
e.preventDefault();
89+
});
90+
}
8991
}
9092
}
93+
const toggle_pw_button = document.getElementById('toggle-pw-button');
94+
if (toggle_pw_button)
95+
toggle_pw_button.addEventListener('click', toggle_password);
96+
97+
})();
98+
99+
function toggle_password(e) {
100+
var button = e.target;
101+
var input = button.parentNode.parentNode.querySelector("input");
102+
switch(input.attributes.type.value) {
103+
case "password":
104+
input.attributes.type.value = "text";
105+
button.innerText = button.getAttribute('data-text-hide');
106+
break;
107+
case "text":
108+
input.attributes.type.value = "password";
109+
button.innerText = button.getAttribute('data-text-show');
110+
break;
111+
}
112+
}
113+
114+
(function() {
115+
'use strict';
116+
window.addEventListener('load', function() {
117+
// Fetch all the forms we want to apply custom Bootstrap validation styles to
118+
var forms = document.getElementsByClassName('needs-validation');
119+
// Loop over them and prevent submission
120+
var validation = Array.prototype.filter.call(forms, function(form) {
121+
form.addEventListener('submit', function(event) {
122+
if (form.checkValidity() === false) {
123+
event.preventDefault();
124+
event.stopPropagation();
125+
}
126+
form.classList.add('was-validated');
127+
}, false);
128+
});
129+
}, false);
91130
})();

‎src/mod_invites_http.erl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,6 @@ binary_join(List, Sep) ->
483483

484484
security_headers() ->
485485
[{<<"Content-Security-Policy">>,
486-
<<"default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'">>},
486+
<<"default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'">>},
487487
{<<"X-Content-Type-Options">>, <<"nosniff">>},
488488
{<<"Referrer-Policy">>, <<"no-referrer">>}].

0 commit comments

Comments
 (0)