v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/web/templates/familygate.html

@@ -20,6 +20,7 @@
         {{- if .SignedIn}}
         <p id="family-gate-signed-in">{{T "family_gate.signed_in_note"}}</p>
         <form method="post" action="/__family/logout">
+            <input type="hidden" name="_ft" value="{{.LogoutToken}}">
             <button type="submit" class="btn btn-outline btn-full">{{T "family_gate.sign_out"}}</button>
         </form>
         {{- else}}

controller/internal/web/templates/layout.html

@@ -125,7 +125,7 @@
             </ul>
             <div class="sidebar-footer">
                 <span class="version">{{.Version}}</span>{{if .LangSwitch}}{{template "lang_globe" .}}{{end}}
-                {{if .AuthEnabled}}<a href="/logout" class="logout-link">{{T "layout.kijelentkezes"}}</a>{{end}}
+                {{if .AuthEnabled}}<form method="post" action="/logout" class="logout-form">{{.CSRFField}}<button type="submit" class="logout-link">{{T "layout.kijelentkezes"}}</button></form>{{end}}
             </div>
         </div>
     </nav>

controller/internal/web/templates/settings_security.html

@@ -19,12 +19,12 @@
             </div>
             <div class="form-group">
                 <label for="new_password">{{T "settings_security.uj_jelszo"}}</label>
-                <input type="password" id="new_password" name="new_password" required minlength="8"
-                       placeholder="{{T "settings_security.legalabb_8_karakter"}}" class="form-control">
+                <input type="password" id="new_password" name="new_password" required minlength="{{.MinPassword}}"
+                       placeholder="{{T "settings_security.legalabb_karakter"}}" class="form-control">
             </div>
             <div class="form-group">
                 <label for="confirm_password">{{T "settings_security.uj_jelszo_megerositese"}}</label>
-                <input type="password" id="confirm_password" name="confirm_password" required minlength="8"
+                <input type="password" id="confirm_password" name="confirm_password" required minlength="{{.MinPassword}}"
                        placeholder="{{T "settings_security.jelszo_megegyszer"}}" class="form-control">
             </div>
             <button type="submit" class="btn btn-primary">{{T "settings_security.jelszo_modositasa"}}</button>

controller/internal/web/templates/style.css

@@ -150,7 +150,8 @@ body {
 .lang-globe-item:hover { color: var(--blue-bright); }
 .lang-globe-item.current { color: var(--text-1); font-weight: 600; }
 .lang-globe-item.current::after { content: " \2713"; }
-.logout-link { color: var(--text-3); text-decoration: none; transition: color 0.2s ease; }
+.logout-form { display: inline; margin: 0; }
+.logout-link { color: var(--text-3); text-decoration: none; transition: color 0.2s ease; background: none; border: 0; padding: 0; font: inherit; cursor: pointer; }
 .logout-link:hover { color: var(--blue-bright); }
 /* Mobile chrome (v0.166.0) — hidden by default so desktop (>768px) stays pixel-identical; the
    ≤768px block below turns the top bar on and converts the sidebar into an off-canvas drawer. */