fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline <script> blocks to external JS files, replace all inline event handlers (onclick, onerror) with addEventListener, and remove createElement('style') from icons.js. All changes support the strict CSP policy (style-src 'self'; script-src 'self') without weakening it.
2026-03-05 16:18:30 -05:00
parent f2d35ca792
commit c08926b817
28 changed files with 397 additions and 212 deletions
@@ -0,0 +1,33 @@
+// Read error type from URL query parameter
+var params = new URLSearchParams(window.location.search);
+var errorType = params.get('type') || 'generic';
+
+var errorTitle = document.getElementById('error-title');
+var errorMessage = document.getElementById('error-message');
+var errorAction = document.getElementById('error-action');
+
+switch(errorType) {
+    case 'invalid-credentials':
+        errorTitle.textContent = 'Login Failed';
+        errorMessage.textContent = 'Invalid username or password. Please check your credentials and try again.';
+        errorAction.textContent = 'Try Again';
+        errorAction.addEventListener('click', function() { history.back(); });
+        break;
+    case 'session-expired':
+        errorTitle.textContent = 'Session Expired';
+        errorMessage.textContent = 'Your session has expired. Please try again.';
+        errorAction.textContent = 'Close Window';
+        errorAction.addEventListener('click', function() { window.close(); });
+        break;
+    case 'not-found':
+        errorTitle.textContent = 'Not Found';
+        errorMessage.textContent = 'The requested page was not found.';
+        errorAction.textContent = 'Close Window';
+        errorAction.addEventListener('click', function() { window.close(); });
+        break;
+    default:
+        errorTitle.textContent = 'Error';
+        errorMessage.textContent = 'An unexpected error occurred. Please try again.';
+        errorAction.textContent = 'Close Window';
+        errorAction.addEventListener('click', function() { window.close(); });
+}