Brummel
2c6062a53e
The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.
The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.
Pre-production: no transition redirects.
30 lines
1.0 KiB
HTML
30 lines
1.0 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Doctate — Login</title>
|
|
<style>
|
|
body { font-family: sans-serif; max-width: 360px; margin: 4em auto; padding: 0 1em; }
|
|
h1 { font-size: 1.8em; margin: 0 0 1em; text-align: center; }
|
|
form { display: flex; flex-direction: column; gap: 0.8em; }
|
|
label { display: flex; flex-direction: column; gap: 0.25em; font-size: 0.9em; color: #555; }
|
|
input, button { box-sizing: border-box; width: 100%; padding: 0.6em; font-size: 1em; font-family: inherit; }
|
|
button { cursor: pointer; margin-top: 0.4em; }
|
|
.error { background: #fee; border: 1px solid #e99; padding: 0.5em; border-radius: 4px; color: #900; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>Doctate</h1>
|
|
{% match error %}
|
|
{% when Some with (msg) %}
|
|
<div class="error">{{ msg }}</div>
|
|
{% when None %}
|
|
{% endmatch %}
|
|
<form method="post" action="/login">
|
|
<label>Benutzer<input type="text" name="slug" autofocus required></label>
|
|
<label>Passwort<input type="password" name="password" required></label>
|
|
<button type="submit">Anmelden</button>
|
|
</form>
|
|
</body>
|
|
</html>
|