fen
7a74ff3e74
- Move all inline <script> blocks (layout head/theme, topbar dark toggle, foot, paste, new, history, mine, settings, admin, unlock) to external files under internal/web/static/. Page data reaches scripts via data-* attributes (data-paste-id, data-default-dark) instead of template vars. - Replace inline onclick handlers (copy, delete, stats toggle) with addEventListener wiring. - Convert inline style="" attributes to CSS utility classes; swatch colors are now set via CSSOM/DOM APIs instead of innerHTML strings. - script-src/style-src are now plain 'self'; img-src data: stays for the SVG data-URI backgrounds. Verified with headless chromium: zero CSP violations on all pages in dark and light presets, theme swatches, admin lock, tables and paste view render correctly.
8 lines
337 B
JavaScript
8 lines
337 B
JavaScript
// #139: unlock page: password reveal toggle.
|
|
document.getElementById('pwreveal').addEventListener('click', () => {
|
|
const pw = document.getElementById('password');
|
|
const show = pw.type === 'password';
|
|
pw.type = show ? 'text' : 'password';
|
|
document.getElementById('pwreveal').title = show ? 'Hide password' : 'Show password';
|
|
});
|