Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
152 lines
6.7 KiB
HTML
152 lines
6.7 KiB
HTML
{% extends "base.html" %}
|
|
{% import "partials/icons.html" as ico %}
|
|
|
|
{% block head_title %}Add printer · ImpTune{% endblock %}
|
|
{% block crumb %}
|
|
<span class="crumb" x-data>
|
|
<a href="/printers">{{ ico.i('back', 12) }}<span x-text="$store.i18n.t('back_to_printer_library')">Printers</span></a>
|
|
</span>
|
|
{% endblock %}
|
|
{% block page_title %}<span x-data x-text="$store.i18n.t('add_printer_title')">Add printer</span>{% endblock %}
|
|
|
|
{% block content %}
|
|
<div class="split" x-data="{ ip: '', port: '', portEdited: false }">
|
|
<section class="card">
|
|
<div class="card-body">
|
|
<form action="/printers" method="post">
|
|
|
|
<fieldset class="form-section">
|
|
<legend x-text="$store.i18n.t('section_identity')">Identity</legend>
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('printer_name')">Printer name</span>
|
|
<input type="text" name="name" placeholder="HP LaserJet 4050 — Accounting" required>
|
|
<span class="hint" x-text="$store.i18n.t('hint_name')">The name the user sees on their workstation.</span>
|
|
</label>
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('client')">Client</span>
|
|
<select name="client_id">
|
|
<option value="" x-text="$store.i18n.t('unassigned_option')">Unassigned</option>
|
|
{% for c in clients %}
|
|
<option value="{{ c.id }}">{{ c.name }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
</label>
|
|
</fieldset>
|
|
|
|
<fieldset class="form-section">
|
|
<legend x-text="$store.i18n.t('section_connection')">Network connection</legend>
|
|
<div class="form-row">
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('ip_address')">IP address</span>
|
|
<input type="text" name="ip_address" class="mono"
|
|
x-model="ip"
|
|
@input="if (!portEdited) port = 'IP_' + ip.replaceAll('.', '_')"
|
|
placeholder="192.168.1.100"
|
|
inputmode="decimal"
|
|
required>
|
|
<span class="hint" x-text="$store.i18n.t('hint_ip')">The printer IPv4 address on the client network.</span>
|
|
</label>
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('port_name')">Port name</span>
|
|
<input type="text" name="port_name" class="mono"
|
|
x-model="port"
|
|
@change="portEdited = true"
|
|
@keydown="portEdited = true"
|
|
placeholder="IP_192_168_1_100">
|
|
<span class="hint" x-text="$store.i18n.t('hint_port')">Derived from the IP address. Edit it if your naming differs.</span>
|
|
</label>
|
|
</div>
|
|
</fieldset>
|
|
|
|
<fieldset class="form-section">
|
|
<legend x-text="$store.i18n.t('section_driver')">Driver</legend>
|
|
<label>
|
|
<select name="driver_id" id="printer-form-driver-select">
|
|
<option value="" x-text="$store.i18n.t('no_driver_option')">No driver</option>
|
|
{% for item in driver_data %}
|
|
<option value="{{ item.driver.id }}">
|
|
{{ item.driver.original_filename }}{% if item.names %} — {{ item.names | join(', ') }}{% endif %}
|
|
</option>
|
|
{% endfor %}
|
|
</select>
|
|
<span class="hint" x-text="$store.i18n.t('hint_driver')">Without a driver the printer is saved, but export stays locked.</span>
|
|
</label>
|
|
</fieldset>
|
|
|
|
<fieldset class="form-section">
|
|
<legend x-text="$store.i18n.t('section_defaults')">Print defaults</legend>
|
|
<div class="form-row">
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('duplex_mode')">Duplex mode</span>
|
|
<select name="duplex_mode">
|
|
<option value="OneSided" selected x-text="$store.i18n.t('one_sided')">One-sided</option>
|
|
<option value="LongEdge" x-text="$store.i18n.t('long_edge')">Long edge</option>
|
|
<option value="ShortEdge" x-text="$store.i18n.t('short_edge')">Short edge</option>
|
|
</select>
|
|
</label>
|
|
<label>
|
|
<span class="label-text" x-text="$store.i18n.t('paper_size')">Paper size</span>
|
|
<select name="paper_size">
|
|
<option value="A4" selected>A4</option>
|
|
<option value="Letter">Letter</option>
|
|
<option value="Legal">Legal</option>
|
|
</select>
|
|
</label>
|
|
</div>
|
|
<div class="check-row">
|
|
<label>
|
|
<input type="checkbox" name="color_mode" value="on" checked>
|
|
<span x-text="$store.i18n.t('color_mode')">Color</span>
|
|
</label>
|
|
<label>
|
|
<input type="checkbox" name="collate" value="on" checked>
|
|
<span x-text="$store.i18n.t('collate')">Collate</span>
|
|
</label>
|
|
</div>
|
|
</fieldset>
|
|
|
|
<div class="form-foot">
|
|
<button type="submit" class="btn" x-text="$store.i18n.t('save_printer')">Save printer</button>
|
|
<a href="/printers" class="btn ghost" x-text="$store.i18n.t('cancel')">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</section>
|
|
|
|
{#
|
|
Separate form on purpose: HTML forbids nesting, and the upload answers a
|
|
question the technician has *while* filling the form ("my driver isn't in
|
|
the list"). The response OOB-swaps the select above, new driver selected.
|
|
#}
|
|
<section class="card form-aside">
|
|
<div class="card-head">
|
|
<div>
|
|
<h2 x-data x-text="$store.i18n.t('upload_new_driver')">Add a new driver</h2>
|
|
<p class="sub" x-data x-text="$store.i18n.t('hint_driver_zip')">The ZIP must contain the .inf file and every file it references.</p>
|
|
</div>
|
|
</div>
|
|
<div class="card-body">
|
|
<form hx-post="/drivers/upload"
|
|
hx-target="#driver-list"
|
|
hx-encoding="multipart/form-data"
|
|
hx-swap="outerHTML"
|
|
hx-indicator="#form-upload-spinner">
|
|
<input type="hidden" name="caller" value="printer_form">
|
|
<div class="uploader">
|
|
<input type="file" name="file" accept=".zip" required
|
|
x-data :aria-label="$store.i18n.t('driver_package_label')">
|
|
<div class="btn-row">
|
|
<button type="submit" class="btn ghost" x-data>
|
|
{{ ico.i('upload', 14) }}<span x-text="$store.i18n.t('upload_btn')">Upload</span>
|
|
</button>
|
|
<span id="form-upload-spinner" class="htmx-indicator" aria-busy="true"
|
|
x-data x-text="$store.i18n.t('uploading')">Uploading…</span>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
<div id="driver-list"></div>
|
|
</div>
|
|
</section>
|
|
</div>
|
|
{% endblock %}
|