admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub: F-16 — inline two-step confirm partial replaces every native confirm() (offsite/PBS re-issue, freeze, telemetry reset, dismiss-all, regen-password, claim-resend, block/delete, geo-disable); hub_confirm_gate.py enforces zero

Browse Source 
Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC
This commit is contained in:
authentik Default Admin
2026-07-13 08:19:54 +02:00
parent bad9203daa
commit 5d66c62bd6
7 changed files with 93 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/web/templates/customer_unified.html
+12 -13
View File
@@ -7,6 +7,7 @@
<link rel="stylesheet" href="/style.css?v={{hubVersion}}">
<meta name="csrf-token" content="{{.CSRFToken}}">
<script>function csrfHeaders(){var el=document.querySelector('meta[name="csrf-token"]');return el?{'X-CSRF-Token':el.content}:{};}</script>
{{template "inline_confirm_js"}}
</head>
<body>
{{template "icon_sprite"}}
@@ -405,10 +406,9 @@
</div>
<span class="form-hint">The per-customer secret that fetches the whole config — masked by default; never place it on a command line (the installer reads it at a no-echo prompt).</span>
</div>
<form method="POST" action="/configs/{{.CustomerID}}/regen-password" style="margin-top: 0.5rem;"
onsubmit="return confirm('Regenerate retrieval password? The old password will stop working immediately.')">
<form method="POST" action="/configs/{{.CustomerID}}/regen-password" style="margin-top: 0.5rem;">
{{.CSRFField}}
<button type="submit" class="btn btn-outline btn-sm">Regenerate</button>
<button type="submit" class="btn btn-outline btn-sm" data-confirm="Regenerate retrieval password? The old password will stop working immediately.">Regenerate</button>
</form>
</div>
<div class="credential-row" style="margin-top: 1rem;">
@@ -446,10 +446,9 @@
<span class="form-hint">The customer sets + owns the dashboard password (claim code → own password). The code goes ONLY to the registered address ({{.Email}}); the hub stores a hash — no plaintext code exists to display.</span>
</div>
{{if .Claim}}
<form method="POST" action="/configs/{{.CustomerID}}/claim-resend" style="margin-top: 0.5rem;"
onsubmit="return confirm('Send a fresh code to the registered address? The previous code stops working immediately.')">
<form method="POST" action="/configs/{{.CustomerID}}/claim-resend" style="margin-top: 0.5rem;">
{{.CSRFField}}
<button type="submit" class="btn btn-outline btn-sm">{{if .Claim.ClaimedAt}}Visszaállító kód küldése{{else}}Kód újraküldése{{end}}</button>
<button type="submit" class="btn btn-outline btn-sm" data-confirm="Send a fresh code to the registered address? The previous code stops working immediately (the box activates it on its next report, ~15 min).">{{if .Claim.ClaimedAt}}Visszaállító kód küldése{{else}}Kód újraküldése{{end}}</button>
</form>
{{end}}
</div>
@@ -713,16 +712,14 @@
<button type="submit" class="btn btn-sm">Unblock</button>
</form>
{{else}}
<form method="POST" action="/customers/{{.CustomerID}}/block" style="display:inline"
onsubmit="return confirm('Block this customer? They will be hidden from the Dashboard.')">
<form method="POST" action="/customers/{{.CustomerID}}/block" style="display:inline">
{{.CSRFField}}
<button type="submit" class="btn btn-outline btn-sm">Block</button>
<button type="submit" class="btn btn-outline btn-sm" data-confirm="Block this customer? They will be hidden from the Dashboard.">Block</button>
</form>
{{end}}
<form method="POST" action="/configs/{{.CustomerID}}/delete" style="display:inline"
onsubmit="return confirm('Delete configuration for {{.CustomerID}}? This cannot be undone.')">
<form method="POST" action="/configs/{{.CustomerID}}/delete" style="display:inline">
{{.CSRFField}}
<button type="submit" class="btn btn-danger btn-sm">Delete</button>
<button type="submit" class="btn btn-danger btn-sm" data-confirm="Delete configuration for {{.CustomerID}}? This cannot be undone.">Delete</button>
</form>
</div>
</section>
@@ -1047,7 +1044,8 @@
if (document.getElementById('gen-controls')) { genUpdate(); }
function disableGeo(customerID) {
if (!confirm('Összes geo-korlátozás eltávolítása?\n\nEz közvetlenül törli a Cloudflare WAF szabályokat és értesíti a controllert.')) return;
var geoBtn = document.getElementById('btn-geo-disable');
felhomConfirm(geoBtn, 'Összes geo-korlátozás eltávolítása? Ez közvetlenül törli a Cloudflare WAF szabályokat és értesíti a controllert.', function () {
var btn = document.getElementById('btn-geo-disable');
var msg = document.getElementById('geo-msg');
btn.disabled = true;
@@ -1076,6 +1074,7 @@
btn.disabled = false;
btn.textContent = 'Összes geo-korlátozás eltávolítása';
});
});
}
{{if .HasConfig}}
// Load YAML preview