mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-08-30 14:52:51 +08:00
d00f
ed74ec1e97
Two hygiene fixes for the web UI, prompted by a login that appeared to fail under privacy shields (Brave Shields / NoScript-family extensions): - httpd: replace the partial "style-src 'self' 'unsafe-inline'" CSP with a complete, first-party policy (default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; form-action 'self'). Everything the UI needs is same-origin; the explicit policy stops shields injecting their own restrictive report-only probes (the noisy script-src-elem 'none' console spam) and passes a strict-CSP audit. Verified: no CSP violations in-browser. - login.html: add autocomplete="current-password" so password managers recognise the field (they showed "unknown password" without it). NOTE: these do NOT bypass a browser's LAN-device protection (NoScript "lan" / Brave Shields), which strips the POST body of requests to a LAN address and is why the login can fail in-browser while the same credentials work over curl. That is a deliberate browser security feature; the user must allow the site in their shields to log in. The backend password (default 1234) is unchanged and correct.
31 lines
966 B
HTML
31 lines
966 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<title data-i18n="login_title">RTL Switch Login</title>
|
|
<link rel="stylesheet" href="style.css">
|
|
<script src="/i18n.js"></script>
|
|
<script>
|
|
function removeNote() {
|
|
document.getElementById("incorrect").innerHTML = "";
|
|
}
|
|
window.addEventListener("load", function() {
|
|
if (document.referrer.endsWith("login.html"))
|
|
document.getElementById("incorrect").innerHTML = t('login_wrong');
|
|
});
|
|
</script>
|
|
</head>
|
|
|
|
<body class="login_page">
|
|
<div class = "center">
|
|
<h1 data-i18n="login_heading"> RTL Switch Login</h1>
|
|
<form method="post" action="login">
|
|
<div class="txt_field">
|
|
<input name="pwd" type="password" autocomplete="current-password" onclick="removeNote()" required />
|
|
<span></span>
|
|
<label data-i18n="login_password">Password</label>
|
|
</div>
|
|
<input type="submit" data-i18n="login_login" value="Login"/>
|
|
<h3 id="incorrect" style="margin-top: 5em;"></h3>
|
|
</form>
|
|
</body>
|
|
</html>
|