admin
15206314ab
Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest launcher: same tiles, opens apps in new tabs, no account, no admin session. Information only, zero control — every privilege stays behind each app's own auth. - /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest password POST carries its own pre-auth HMAC CSRF. - Constant-time token match; empty stored token = disabled = byte-identical mux 404. - Optional per-share password: separate bcrypt hash + own attempt map; signed cookie = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates. - Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary. - Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT. - Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable. - Tests: Groups A-G (14) + 3 red-proofs verified red.
28 lines
1010 B
HTML
28 lines
1010 B
HTML
{{define "launcher_share_password"}}
|
|
<!DOCTYPE html>
|
|
<html lang="hu">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta name="robots" content="noindex, nofollow">
|
|
<title>Indítópult</title>
|
|
<link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
|
|
<link rel="stylesheet" href="/static/style.css">
|
|
</head>
|
|
<body class="guest-body guest-gate-body">
|
|
<main class="guest-gate">
|
|
<div class="guest-gate-card">
|
|
<h2>Indítópult</h2>
|
|
<p>Ez az oldal jelszóval védett.</p>
|
|
{{if .Error}}<div class="gate-error">{{.Error}}</div>{{end}}
|
|
<form method="POST" action="{{.Action}}">
|
|
<input type="hidden" name="_csrf" value="{{.CSRF}}">
|
|
<input type="password" name="password" placeholder="Jelszó" autocomplete="current-password" autofocus>
|
|
<button type="submit" class="btn btn-primary">Belépés</button>
|
|
</form>
|
|
</div>
|
|
</main>
|
|
</body>
|
|
</html>
|
|
{{end}}
|