mix
9333e2657c
Groundwork for the Content-Security-Policy of phase 14.A. A policy that has to
allow inline script is not worth writing — script-src 'unsafe-inline' gives
back exactly the XSS foothold the policy exists to remove — so the three
inline constructs the templates still had are moved out first:
- the layout's <style> block becomes /static/panel.css;
- the one style="background:#b42318" attribute becomes the .danger class
that already existed for it;
- the four onsubmit="return confirm(...)" handlers become data-confirm,
handled by a delegated listener in panel.js. Delegation matters: the
application rows are also delivered by HTMX swaps.
htmx would otherwise inject a <style> of its own for the request-indicator
classes and become the single reason the policy needs an exemption; the panel
uses no hx-indicator, so the meta config switches it off.
A guard test keeps this from silently regressing later, which it otherwise
would: an inline handler added to a template does not fail, it just quietly
stops working in the browser.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
955 B
HTML
25 lines
955 B
HTML
{{define "content"}}
|
|
<h1>Delete {{.Domain.Name}}</h1>
|
|
|
|
<a class="back" href="/domains/{{.Domain.ID}}">← Back to {{.Domain.Name}}</a>
|
|
|
|
<div class="card">
|
|
<h2>Confirm deletion</h2>
|
|
<p>You are about to delete <strong>{{.Domain.Name}}</strong>. This will:</p>
|
|
<ul>
|
|
<li>permanently delete its DKIM signing key;</li>
|
|
<li>delete
|
|
{{if eq .Domain.AppCount 0}}its (currently none) bound applications{{else}}
|
|
<strong>all {{.Domain.AppCount}} bound application(s)</strong>, including
|
|
their SASL credentials and sender bindings{{end}};</li>
|
|
<li>reload OpenDKIM so the domain is no longer signed.</li>
|
|
</ul>
|
|
<p class="muted">This cannot be undone. The published DKIM DNS record becomes
|
|
invalid; remove it from DNS if you do not plan to re-add the domain.</p>
|
|
|
|
<form method="post" action="/domains/{{.Domain.ID}}/delete">
|
|
<button type="submit" class="danger">Delete {{.Domain.Name}}</button>
|
|
</form>
|
|
</div>
|
|
{{end}}
|