Dionisio
b503e08384
- Fix #1: Share handler IDOR - enforce owner check on share operations - Fix #2: list_files_query IDOR - bind folder queries to authenticated user - Fix #3: Dedup handler IDOR - restrict dedup operations to file owner - Fix #4: Trash handler OptionalAuthUser - require full AuthUser - Fix #5: Error info leakage - sanitize 500 error responses - Fix #6: Chunked upload IDOR - bind upload sessions to user_id, add verify_session_owner() check on all session operations - Fix #7: CSP unsafe-inline removal - migrate all inline scripts, styles and event handlers to external files, tighten CSP to script-src 'self'; style-src 'self' New files: - static/js/core/theme-init.js (render-blocking theme init) - static/js/core/sw-register.js (service worker registration) - static/css/views/device-verify.css (extracted inline styles) - static/js/views/device-verify/device-verify.js (extracted inline script)
123 lines
4.6 KiB
HTML
123 lines
4.6 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>OxiCloud — My Profile</title>
|
|
<script src="/js/core/theme-init.js"></script>
|
|
<script src="/js/core/icons.js" defer></script>
|
|
<script src="/js/core/csrf.js" defer></script>
|
|
<link rel="stylesheet" href="/css/main.css">
|
|
<link rel="stylesheet" href="/css/views/profile.css">
|
|
</head>
|
|
<body>
|
|
|
|
<div class="profile-header">
|
|
<div class="profile-header-left">
|
|
<a href="/" class="profile-logo-link link-reset-flex">
|
|
<div class="profile-logo">
|
|
<svg viewBox="0 0 500 500">
|
|
<path d="M345 310c32 0 58-26 58-58s-26-58-58-58c-6.2 0-12 0.9-17.5 2.7C318 166 289 143 255 143c-34.3 0-63.1 22.6-73 53.7C176.9 195.7 171 195 165 195c-32 0-58 26-58 58s26 58 58 58h180z"/>
|
|
</svg>
|
|
</div>
|
|
<span class="profile-title-text">OxiCloud</span>
|
|
</a>
|
|
<span class="profile-title-separator">· Profile</span>
|
|
</div>
|
|
<div class="profile-header-right">
|
|
<a href="/"><i class="fas fa-arrow-left"></i> Back to OxiCloud</a>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-container">
|
|
<div id="loading"><i class="fas fa-circle-notch"></i> Loading…</div>
|
|
<div id="auth-error">
|
|
<div class="err-icon"><i class="fas fa-lock"></i></div>
|
|
<h2>Not Authenticated</h2>
|
|
<p>Please sign in to view your profile.</p>
|
|
<a href="/login"><i class="fas fa-sign-in-alt"></i> Sign in</a>
|
|
</div>
|
|
|
|
<div id="main-content">
|
|
<div class="profile-card">
|
|
<div class="avatar-section">
|
|
<div class="avatar-large" id="p-avatar">—</div>
|
|
<div class="avatar-info">
|
|
<h1 id="p-username">—</h1>
|
|
<div class="email" id="p-email">—</div>
|
|
<span class="role-badge" id="p-role-badge">—</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card">
|
|
<h2><i class="fas fa-id-card"></i> Account Details</h2>
|
|
<div class="info-grid">
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-user"></i> Username</div>
|
|
<div class="info-value" id="p-detail-username">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-envelope"></i> Email</div>
|
|
<div class="info-value" id="p-detail-email">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-shield-alt"></i> Role</div>
|
|
<div class="info-value" id="p-detail-role">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-clock"></i> Last Login</div>
|
|
<div class="info-value" id="p-detail-login">—</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card">
|
|
<h2><i class="fas fa-hdd"></i> Storage</h2>
|
|
<div class="storage-stats">
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-used">—</div>
|
|
<div class="stat-label">Used</div>
|
|
</div>
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-quota">—</div>
|
|
<div class="stat-label">Quota</div>
|
|
</div>
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-pct">—</div>
|
|
<div class="stat-label">Usage</div>
|
|
</div>
|
|
</div>
|
|
<div class="storage-bar-wrap">
|
|
<div class="storage-bar"><div class="storage-fill green width-zero" id="p-storage-bar"></div></div>
|
|
<div class="storage-text" id="p-storage-text">—</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card" id="password-section">
|
|
<h2><i class="fas fa-key"></i> Change Password</h2>
|
|
<form id="password-form">
|
|
<div class="form-group">
|
|
<label for="current-password">Current Password</label>
|
|
<input type="password" id="current-password" required autocomplete="current-password">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="new-password">New Password</label>
|
|
<input type="password" id="new-password" required minlength="8" autocomplete="new-password">
|
|
<small>At least 8 characters</small>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="confirm-password">Confirm New Password</label>
|
|
<input type="password" id="confirm-password" required minlength="8" autocomplete="new-password">
|
|
</div>
|
|
<button type="submit" class="btn btn-primary" id="pw-submit"><i class="fas fa-save"></i> Update Password</button>
|
|
<div id="pw-status"></div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<script src="/js/views/profile/profile.js" defer></script>
|
|
</body>
|
|
</html>
|