Dionisio
b503e08384
- Fix #1: Share handler IDOR - enforce owner check on share operations - Fix #2: list_files_query IDOR - bind folder queries to authenticated user - Fix #3: Dedup handler IDOR - restrict dedup operations to file owner - Fix #4: Trash handler OptionalAuthUser - require full AuthUser - Fix #5: Error info leakage - sanitize 500 error responses - Fix #6: Chunked upload IDOR - bind upload sessions to user_id, add verify_session_owner() check on all session operations - Fix #7: CSP unsafe-inline removal - migrate all inline scripts, styles and event handlers to external files, tighten CSP to script-src 'self'; style-src 'self' New files: - static/js/core/theme-init.js (render-blocking theme init) - static/js/core/sw-register.js (service worker registration) - static/css/views/device-verify.css (extracted inline styles) - static/js/views/device-verify/device-verify.js (extracted inline script)
54 lines
1.8 KiB
HTML
54 lines
1.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>OxiCloud — Authorize Device</title>
|
|
<link rel="stylesheet" href="/css/views/device-verify.css">
|
|
</head>
|
|
<body>
|
|
<div class="card">
|
|
<div class="logo">
|
|
<h1><span>Oxi</span>Cloud</h1>
|
|
</div>
|
|
|
|
<!-- Step 1: Enter code -->
|
|
<div id="step-code">
|
|
<h2>Authorize Device</h2>
|
|
<p class="subtitle">Enter the code displayed on your WebDAV/CalDAV client to grant access.</p>
|
|
<label for="user-code">Device Code</label>
|
|
<input type="text" id="user-code" placeholder="ABCD-1234" maxlength="9" autocomplete="off" autofocus />
|
|
<div id="error-text" class="error-text hidden"></div>
|
|
|
|
<div id="device-info" class="device-info hidden">
|
|
<div class="row">
|
|
<span class="label">Client</span>
|
|
<span class="value" id="info-client">—</span>
|
|
</div>
|
|
<div class="row">
|
|
<span class="label">Scopes</span>
|
|
<span class="value" id="info-scopes">—</span>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="actions hidden" id="action-buttons">
|
|
<button class="btn-deny" id="btn-deny">Deny</button>
|
|
<button class="btn-approve" id="btn-approve">Approve</button>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Step 2: Result -->
|
|
<div id="status-success" class="status success hidden">
|
|
Device authorized successfully! You can close this page.
|
|
</div>
|
|
<div id="status-denied" class="status denied hidden">
|
|
Authorization denied. The client will not receive access.
|
|
</div>
|
|
<div id="status-error" class="status error hidden"></div>
|
|
</div>
|
|
|
|
<script src="/js/core/csrf.js"></script>
|
|
<script src="/js/views/device-verify/device-verify.js"></script>
|
|
</body>
|
|
</html>
|