Ole-Morten Duesund
4794db76b0
Jinja escaper for HTML, men nettleseren dekoder attributtverdien før JS-parseren ser den, så en tittel med ' kunne bryte ut av strengen. Bekreftelser går nå via data-confirm og én delt handler i base.html. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JcEy43fNYpwg6K6oTKakWR
44 lines
1.6 KiB
HTML
44 lines
1.6 KiB
HTML
<!doctype html>
|
||
<html lang="nb">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<title>{% block title %}Admin{% endblock %} – {{ site.title }}</title>
|
||
<link rel="stylesheet" href="{{ url_for('admin.static', filename='admin.css') }}">
|
||
</head>
|
||
<body>
|
||
<a class="skip" href="#main">Hopp til innhold</a>
|
||
<header class="topbar">
|
||
<a class="brand" href="{{ url_for('admin.index') }}">{{ site.title }}</a>
|
||
{% if user %}
|
||
<nav aria-label="Admin-meny">
|
||
<a href="{{ url_for('admin.index') }}">Innlegg</a>
|
||
{% if user.is_owner %}
|
||
<a href="{{ url_for('admin.users') }}">Brukere</a>
|
||
<a href="{{ url_for('admin.settings') }}">Innstillinger</a>
|
||
{% endif %}
|
||
<a href="{{ url_for('admin.password') }}">Passord</a>
|
||
<a href="{{ url_for('public') }}">Se bloggen</a>
|
||
<form method="post" action="{{ url_for('admin.logout') }}" class="inline">
|
||
<input type="hidden" name="csrf" value="{{ csrf }}">
|
||
<button type="submit" class="link">Logg ut ({{ user.username }})</button>
|
||
</form>
|
||
</nav>
|
||
{% endif %}
|
||
</header>
|
||
<main id="main">
|
||
{% with messages = get_flashed_messages(with_categories=true) %}
|
||
{% for cat, msg in messages %}<p class="flash {{ cat }}" role="status">{{ msg }}</p>{% endfor %}
|
||
{% endwith %}
|
||
{% block content %}{% endblock %}
|
||
</main>
|
||
<script>
|
||
// Bekreftelsesdialoger via data-attributt i stedet for inline onsubmit, slik at
|
||
// tekst fra innhold (titler, brukernavn) aldri havner i en JS-kontekst.
|
||
document.addEventListener("submit", function (ev) {
|
||
var msg = ev.target.dataset && ev.target.dataset.confirm;
|
||
if (msg && !confirm(msg)) ev.preventDefault();
|
||
});
|
||
</script>
|
||
</body>
|
||
</html>
|