palette/internal/web/templates/foot.html at 91757752b8c1c404230ff4f9b6a75e993b6f16f3 - palette - Gitea: Git with a cup of tea

Files

T

fen 7a74ff3e74

CI / test (pull_request) Successful in 30s

Details

CI / docker (pull_request) Skipped

Details

Fix #139 : drop unsafe-inline from script-src and style-src (#139 )

- Move all inline <script> blocks (layout head/theme, topbar dark toggle,
  foot, paste, new, history, mine, settings, admin, unlock) to external
  files under internal/web/static/. Page data reaches scripts via data-*
  attributes (data-paste-id, data-default-dark) instead of template vars.
- Replace inline onclick handlers (copy, delete, stats toggle) with
  addEventListener wiring.
- Convert inline style="" attributes to CSS utility classes; swatch
  colors are now set via CSSOM/DOM APIs instead of innerHTML strings.
- script-src/style-src are now plain 'self'; img-src data: stays for the
  SVG data-URI backgrounds. Verified with headless chromium: zero CSP
  violations on all pages in dark and light presets, theme swatches,
  admin lock, tables and paste view render correctly.

2026-09-10 09:08:17 -05:00

1 line

69 B

HTML

Raw Blame History

{{define "foot"}}<script src="/static/foot.js" defer></script>{{end}}