Dionisio
d2c08d31ba
- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies - Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies - Update auth middleware: 3-method auth (Bearer → Basic → Cookie) - Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy - Implement CSRF double-submit cookie pattern (csrf.rs middleware) - Set CSRF cookie on login/refresh/oidc-exchange, clear on logout - CookieAuthenticated marker skips CSRF for Bearer/Basic clients - Frontend: strip all localStorage token refs from 14 JS files - Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected - 121 tests passing, 0 warnings
123 lines
4.7 KiB
HTML
123 lines
4.7 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>OxiCloud — My Profile</title>
|
|
<script>if(localStorage.getItem('oxicloud_theme')==='dark')document.documentElement.setAttribute('data-theme','dark');</script>
|
|
<script src="/js/core/icons.js" defer></script>
|
|
<script src="/js/core/csrf.js" defer></script>
|
|
<link rel="stylesheet" href="/css/main.css">
|
|
<link rel="stylesheet" href="/css/views/profile.css">
|
|
</head>
|
|
<body>
|
|
|
|
<div class="profile-header">
|
|
<div class="profile-header-left">
|
|
<a href="/" class="profile-logo-link link-reset-flex">
|
|
<div class="profile-logo">
|
|
<svg viewBox="0 0 500 500">
|
|
<path d="M345 310c32 0 58-26 58-58s-26-58-58-58c-6.2 0-12 0.9-17.5 2.7C318 166 289 143 255 143c-34.3 0-63.1 22.6-73 53.7C176.9 195.7 171 195 165 195c-32 0-58 26-58 58s26 58 58 58h180z"/>
|
|
</svg>
|
|
</div>
|
|
<span class="profile-title-text">OxiCloud</span>
|
|
</a>
|
|
<span class="profile-title-separator">· Profile</span>
|
|
</div>
|
|
<div class="profile-header-right">
|
|
<a href="/"><i class="fas fa-arrow-left"></i> Back to OxiCloud</a>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-container">
|
|
<div id="loading"><i class="fas fa-circle-notch"></i> Loading…</div>
|
|
<div id="auth-error">
|
|
<div class="err-icon"><i class="fas fa-lock"></i></div>
|
|
<h2>Not Authenticated</h2>
|
|
<p>Please sign in to view your profile.</p>
|
|
<a href="/login"><i class="fas fa-sign-in-alt"></i> Sign in</a>
|
|
</div>
|
|
|
|
<div id="main-content">
|
|
<div class="profile-card">
|
|
<div class="avatar-section">
|
|
<div class="avatar-large" id="p-avatar">—</div>
|
|
<div class="avatar-info">
|
|
<h1 id="p-username">—</h1>
|
|
<div class="email" id="p-email">—</div>
|
|
<span class="role-badge" id="p-role-badge">—</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card">
|
|
<h2><i class="fas fa-id-card"></i> Account Details</h2>
|
|
<div class="info-grid">
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-user"></i> Username</div>
|
|
<div class="info-value" id="p-detail-username">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-envelope"></i> Email</div>
|
|
<div class="info-value" id="p-detail-email">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-shield-alt"></i> Role</div>
|
|
<div class="info-value" id="p-detail-role">—</div>
|
|
</div>
|
|
<div class="info-item">
|
|
<div class="info-label"><i class="fas fa-clock"></i> Last Login</div>
|
|
<div class="info-value" id="p-detail-login">—</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card">
|
|
<h2><i class="fas fa-hdd"></i> Storage</h2>
|
|
<div class="storage-stats">
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-used">—</div>
|
|
<div class="stat-label">Used</div>
|
|
</div>
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-quota">—</div>
|
|
<div class="stat-label">Quota</div>
|
|
</div>
|
|
<div class="storage-stat">
|
|
<div class="stat-value" id="p-storage-pct">—</div>
|
|
<div class="stat-label">Usage</div>
|
|
</div>
|
|
</div>
|
|
<div class="storage-bar-wrap">
|
|
<div class="storage-bar"><div class="storage-fill green width-zero" id="p-storage-bar"></div></div>
|
|
<div class="storage-text" id="p-storage-text">—</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="profile-card" id="password-section">
|
|
<h2><i class="fas fa-key"></i> Change Password</h2>
|
|
<form id="password-form" onsubmit="return changePassword(event)">
|
|
<div class="form-group">
|
|
<label for="current-password">Current Password</label>
|
|
<input type="password" id="current-password" required autocomplete="current-password">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="new-password">New Password</label>
|
|
<input type="password" id="new-password" required minlength="8" autocomplete="new-password">
|
|
<small>At least 8 characters</small>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="confirm-password">Confirm New Password</label>
|
|
<input type="password" id="confirm-password" required minlength="8" autocomplete="new-password">
|
|
</div>
|
|
<button type="submit" class="btn btn-primary" id="pw-submit"><i class="fas fa-save"></i> Update Password</button>
|
|
<div id="pw-status"></div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<script src="/js/views/profile/profile.js" defer></script>
|
|
</body>
|
|
</html>
|