steve/check-printing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: replace inline onclick handlers blocked by CSP with event delegation

Browse Source 
The Content-Security-Policy header (default-src 'self') blocked inline
onclick attributes, silently preventing the Edit and Delete buttons in
the user management modal from firing. Replaced with data-id attributes
and a delegated click listener on the users-list container.
This commit is contained in:
Steve Dogiakos
2026-03-31 10:49:23 -06:00
parent 3b1f196f67
commit acf8f9f4da
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/js/app.js
+8 -2
View File
@@ -209,8 +209,8 @@ function renderUsersList() {
<td>${roleBadge(u.role)}</td> <td>${roleBadge(u.role)}</td>
<td style="font-size:12px">${accountsLabel}</td> <td style="font-size:12px">${accountsLabel}</td>
<td style="white-space:nowrap"> <td style="white-space:nowrap">
<button class="btn-sm btn-secondary" onclick="startUserEdit(${u.id})">Edit</button> <button class="btn-sm btn-secondary user-btn-edit" data-id="${u.id}">Edit</button>
${!isSelf ? `<button class="btn-sm btn-danger" style="margin-left:4px" onclick="deleteUser(${u.id})">Delete</button>` : ''} ${!isSelf ? `<button class="btn-sm btn-danger user-btn-delete" style="margin-left:4px" data-id="${u.id}">Delete</button>` : ''}
</td> </td>
</tr>`; </tr>`;
}).join('')} }).join('')}
@@ -1798,6 +1798,12 @@ async function init() {
document.getElementById('btn-users').addEventListener('click', openUsersModal); document.getElementById('btn-users').addEventListener('click', openUsersModal);
document.getElementById('btn-close-users').addEventListener('click', closeUsersModal); document.getElementById('btn-close-users').addEventListener('click', closeUsersModal);
document.getElementById('users-overlay').addEventListener('click', closeUsersModal); document.getElementById('users-overlay').addEventListener('click', closeUsersModal);
document.getElementById('users-list').addEventListener('click', e => {
const editBtn = e.target.closest('.user-btn-edit');
const deleteBtn = e.target.closest('.user-btn-delete');
if (editBtn) startUserEdit(parseInt(editBtn.dataset.id, 10));
if (deleteBtn) deleteUser(parseInt(deleteBtn.dataset.id, 10));
});
document.getElementById('btn-save-user').addEventListener('click', saveUser); document.getElementById('btn-save-user').addEventListener('click', saveUser);
document.getElementById('btn-cancel-user-edit').addEventListener('click', cancelUserEdit); document.getElementById('btn-cancel-user-edit').addEventListener('click', cancelUserEdit);
document.getElementById('uf-role').addEventListener('change', renderUfAccountCheckboxes); document.getElementById('uf-role').addEventListener('change', renderUfAccountCheckboxes);