kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
21 lines
526 B
HTML
21 lines
526 B
HTML
{% extends "base.html" %}
|
|
|
|
{% block content %}
|
|
<h1>Restore backup key</h1>
|
|
|
|
<p>Paste the key from your <code>imptune-backup-key.txt</code> backup file to
|
|
recover your printers, configs, and groups on this browser.</p>
|
|
|
|
{% if error %}
|
|
<div class="error"><p>{{ error }}</p></div>
|
|
{% endif %}
|
|
|
|
<form method="post" action="/session/restore">
|
|
<label>
|
|
Backup key
|
|
<input type="text" name="key" placeholder="paste your key here" required autofocus>
|
|
</label>
|
|
<button type="submit">Restore</button>
|
|
</form>
|
|
{% endblock %}
|