mirror of
https://github.com/tmdinosaurcenter/kiosk-guestbook.git
synced 2026-06-04 00:17:44 -06:00
steve
ecdcc044b7
Installs Flask-WTF and enables CSRFProtect globally. Adds csrf_token hidden fields to all four POST forms (login, delete entry, add user, delete user, and the public guestbook form). Exempts the API endpoint which uses header-based key auth instead.
85 lines
3.7 KiB
HTML
85 lines
3.7 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>Guestbook Admin</title>
|
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" />
|
|
</head>
|
|
<body class="bg-light">
|
|
<div class="container py-4">
|
|
<div class="d-flex justify-content-between align-items-center mb-4">
|
|
<h1 class="h3 mb-0">Guestbook Admin</h1>
|
|
<div class="d-flex align-items-center gap-3">
|
|
<span class="text-muted">{{ current_user.username }} · {{ total }} entries</span>
|
|
{% if current_user.role == 'superadmin' %}
|
|
<a href="{{ url_for('admin_users') }}" class="btn btn-outline-secondary btn-sm">Manage Users</a>
|
|
{% endif %}
|
|
<a href="{{ url_for('admin_logout') }}" class="btn btn-outline-danger btn-sm">Logout</a>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="table-responsive">
|
|
<table class="table table-bordered table-hover bg-white">
|
|
<thead class="table-dark">
|
|
<tr>
|
|
<th>ID</th>
|
|
<th>Name</th>
|
|
<th>Email</th>
|
|
<th>Location</th>
|
|
<th>Comment</th>
|
|
<th>Newsletter</th>
|
|
<th>Timestamp</th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for g in guests %}
|
|
<tr>
|
|
<td class="text-muted">{{ g[0] }}</td>
|
|
<td>{{ g[1] }} {{ g[2] }}</td>
|
|
<td>{{ g[3] or '—' }}</td>
|
|
<td>{{ g[4] }}</td>
|
|
<td>{{ g[5] or '—' }}</td>
|
|
<td>{{ 'Yes' if g[6] else 'No' }}</td>
|
|
<td class="text-nowrap">{{ g[7] | localtime }}</td>
|
|
<td>
|
|
{% if current_user.role != 'viewer' %}
|
|
<form method="POST" action="{{ url_for('admin_delete', entry_id=g[0]) }}?page={{ page }}"
|
|
onsubmit="return confirm('Delete entry for {{ g[1] }} {{ g[2] }}?')">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
|
|
<button type="submit" class="btn btn-danger btn-sm">Delete</button>
|
|
</form>
|
|
{% endif %}
|
|
</td>
|
|
</tr>
|
|
{% else %}
|
|
<tr>
|
|
<td colspan="8" class="text-center text-muted">No entries found.</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
{% if total_pages > 1 %}
|
|
<nav>
|
|
<ul class="pagination">
|
|
<li class="page-item {% if page == 1 %}disabled{% endif %}">
|
|
<a class="page-link" href="{{ url_for('admin', page=page-1) }}">Previous</a>
|
|
</li>
|
|
{% for p in range(1, total_pages + 1) %}
|
|
<li class="page-item {% if p == page %}active{% endif %}">
|
|
<a class="page-link" href="{{ url_for('admin', page=p) }}">{{ p }}</a>
|
|
</li>
|
|
{% endfor %}
|
|
<li class="page-item {% if page == total_pages %}disabled{% endif %}">
|
|
<a class="page-link" href="{{ url_for('admin', page=page+1) }}">Next</a>
|
|
</li>
|
|
</ul>
|
|
</nav>
|
|
{% endif %}
|
|
</div>
|
|
</body>
|
|
</html>
|