mirror of
https://gitlab.com/crafty-controller/crafty-4.git
synced 2024-08-30 18:23:09 +00:00
78834c1ed0
Initial commit for path traversal for server config only.
265 lines
13 KiB
HTML
265 lines
13 KiB
HTML
{% extends ../base.html %}
|
|
|
|
{% block meta %}
|
|
<!-- <meta http-equiv="refresh" content="60">-->
|
|
{% end %}
|
|
|
|
{% block title %}Crafty Controller - Edit User{% end %}
|
|
|
|
{% block content %}
|
|
|
|
<div class="content-wrapper">
|
|
|
|
<!-- Page Title Header Starts-->
|
|
<div class="row page-title-header">
|
|
<div class="col-12">
|
|
<div class="page-header">
|
|
{% if data['new_user'] %}
|
|
<h4 class="page-title">
|
|
New User
|
|
<br />
|
|
<small>UID: N/A</small>
|
|
</h4>
|
|
{% else %}
|
|
<h4 class="page-title">
|
|
Edit User - {{ data['user']['user_id'] }}
|
|
<br />
|
|
<small>UID: {{ data['user']['user_id'] }}</small>
|
|
</h4>
|
|
{% end %}
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<!-- Page Title Header Ends-->
|
|
|
|
<div class="row">
|
|
|
|
<div class="col-sm-12 grid-margin">
|
|
<div class="card">
|
|
<div class="card-body pt-0">
|
|
<ul class="nav nav-tabs col-md-12 tab-simple-styled " role="tablist">
|
|
<li class="nav-item">
|
|
<a class="nav-link active" href="/panel/{{ 'add_user' if data['new_user'] else 'edit_user' }}?id={{ data['user']['user_id'] }}&subpage=config" role="tab" aria-selected="true">
|
|
<i class="fas fa-cogs"></i>Config</a>
|
|
</li>
|
|
{% if not data['new_user'] %}
|
|
<li class="nav-item">
|
|
<a class="nav-link" href="/panel/add_user?id={{ data['user']['user_id'] }}&subpage=other" role="tab" aria-selected="false">
|
|
<i class="fas fa-folder-tree"></i>Other</a>
|
|
</li>
|
|
{% end %}
|
|
</ul>
|
|
|
|
<div class="row">
|
|
<div class="col-md-6 col-sm-12">
|
|
{% if data['new_user'] %}
|
|
<form id="user_form" class="forms-sample" method="post" action="/panel/add_user">
|
|
{% else %}
|
|
<form id="user_form" class="forms-sample" method="post" action="/panel/edit_user">
|
|
{% end %}
|
|
{% raw xsrf_form_html() %}
|
|
<input type="hidden" name="id" value="{{ data['user']['user_id'] }}">
|
|
<input type="hidden" name="subpage" value="config">
|
|
|
|
|
|
<div class="card">
|
|
<div class="card-header header-sm d-flex justify-content-between align-items-center">
|
|
<h4 class="card-title"><i class="fas fa-user"></i> User Settings</h4>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="form-group">
|
|
<label class="form-label" for="username">User Name <small class="text-muted ml-1"> - What you wish to call this user</small> </label>
|
|
<input type="text" class="form-control" name="username" id="username" value="{{ data['user']['username'] }}" placeholder="User Name" >
|
|
</div>
|
|
<div class="form-group">
|
|
<label class="form-label" for="password0">Password <small class="text-muted ml-1"> - leave blank to don't change</small> </label>
|
|
<input type="password" class="form-control" name="password0" id="password0" value="" placeholder="Password" >
|
|
</div>
|
|
<div class="form-group">
|
|
<label class="form-label" for="password1">Repeat Password <small class="text-muted ml-1"> - leave blank to don't change</small> </label>
|
|
<input type="password" class="form-control" name="password1" id="password1" value="" placeholder="Repeat Password" >
|
|
</div>
|
|
<div class="form-group">
|
|
<label class="form-label" for="language">User Language:</label>
|
|
<select class="form-select" id="language" name="language" form="user_form">
|
|
{% for lang in data['languages'] %}
|
|
<option value="{{lang}}">{{lang}}</option>
|
|
{% end %}
|
|
</select>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-header header-sm d-flex justify-content-between align-items-center">
|
|
<h4 class="card-title"><i class="fas fa-user-tag"></i> Roles <small class="text-muted ml-1"> - the roles this user is a member of</small></h4>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="form-group">
|
|
<div class="table-responsive">
|
|
<table class="table table-hover">
|
|
<thead>
|
|
<tr class="rounded">
|
|
<th>Role Name</th>
|
|
<th>Member?</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for role in data['roles_all'] %}
|
|
<tr>
|
|
<td>{{ role.role_name }}</td>
|
|
<td>
|
|
{% if role.role_id in data['user']['roles'] %}
|
|
<input type="checkbox" class="form-check-input" id="role_{{ role.role_id }}_membership" name="role_{{ role.role_id }}_membership" checked="" value="1">
|
|
{% else %}
|
|
<input type="checkbox" class="form-check-input" id="role_{{ role.role_id }}_membership" name="role_{{ role.role_id }}_membership" value="1">
|
|
{% end %}
|
|
|
|
</td>
|
|
</tr>
|
|
{% end %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<!-- Put Permissions Crafty part here -->
|
|
|
|
<div class="card">
|
|
<div class="card-header header-sm d-flex justify-content-between align-items-center">
|
|
<h4 class="card-title"><i class="fas fa-user-lock"></i> Crafty Permissions <small class="text-muted ml-1"> - permissions this user has on Crafty Controller </small></h4>
|
|
</div>
|
|
<div class="card-body">
|
|
<div class="form-group">
|
|
<div class="table-responsive">
|
|
<table class="table table-hover">
|
|
<thead>
|
|
<tr class="rounded">
|
|
<th>Permission Name</th>
|
|
<th>Authorized ?</th>
|
|
<th>Number of Uses Allowed (-1=No Limit)</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for permission in data['permissions_all'] %}
|
|
<tr>
|
|
<td>{{ permission.name }}</td>
|
|
<td>
|
|
{% if permission in data['permissions_list'] %}
|
|
<input type="checkbox" class="form-check-input" id="permission_{{ permission.name }}" name="permission_{{ permission.name }}" checked="" value="1">
|
|
{% else %}
|
|
<input type="checkbox" class="form-check-input" id="permission_{{ permission.name }}" name="permission_{{ permission.name }}" value="1">
|
|
{% end %}
|
|
</td>
|
|
<td><input type="text" class="form-control" name="quantity_{{ permission.name }}" id="quantity_{{ permission.name }}" value="{{ data['quantity_server'][permission.name] }}"></td>
|
|
</tr>
|
|
{% end %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-check-flat">
|
|
<label for="enabled" class="form-check-label ml-4 mb-4">
|
|
{% if data['user']['enabled'] %}
|
|
<input type="checkbox" class="form-check-input" id="enabled" name="enabled" checked="" value="1">Enabled
|
|
{% else %}
|
|
<input type="checkbox" class="form-check-input" id="enabled" name="enabled" value="1">Enabled
|
|
{% end %}
|
|
</label>
|
|
|
|
<label for="regen_api" class="form-check-label ml-4 mb-4">
|
|
{% if data['new_user'] %}
|
|
<input type="checkbox" class="form-check-input" id="regen_api" name="regen_api" checked="" value="1" disabled >Regenerate API Key
|
|
{% else %}
|
|
<input type="checkbox" class="form-check-input" id="regen_api" name="regen_api" value="1">Regenerate API Key
|
|
{% end %}
|
|
</label>
|
|
|
|
<label for="superuser" class="form-check-label ml-4 mb-4">
|
|
{% if data['user']['superuser'] %}
|
|
<input type="checkbox" class="form-check-input" id="superuser" name="superuser" checked="" value="1" disabled >Super User
|
|
{% else %}
|
|
<input type="checkbox" class="form-check-input" id="superuser" name="superuser" value="1" disabled >Super User
|
|
{% end %}
|
|
</label>
|
|
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-success mr-2"><i class="fas fa-save"></i> {{ translate('panelConfig', 'save', data['lang']) }}</button>
|
|
<button type="reset" onclick="location.href='/panel/panel_config'" class="btn btn-light"><i class="fas fa-undo-alt"></i> {{ translate('panelConfig', 'cancel', data['lang']) }}</button>
|
|
</form>
|
|
</div>
|
|
|
|
<div class="col-md-6 col-sm-12">
|
|
<div class="card">
|
|
<div class="card-body">
|
|
<h4 class="card-title"><i class="fas fa-user-cog"></i> User Config Area</h4>
|
|
<p class="card-description"> Here is where you can change the configuration of your user</p>
|
|
<blockquote class="blockquote">
|
|
<p class="mb-0">
|
|
Created: {{ str(data['user']['created']) }}
|
|
<br />
|
|
Last login: {{ str(data['user']['last_login']) }}
|
|
<br />
|
|
Last update: {{ str(data['user']['last_update']) }}
|
|
<br />
|
|
Last IP: {{ data['user']['last_ip'] }}
|
|
<br />
|
|
API Key: {{ data['user']['api_token'] }}
|
|
<br />
|
|
</p>
|
|
</blockquote>
|
|
</div>
|
|
</div>
|
|
<div class="text-center">
|
|
{% if data['new_user'] %}
|
|
<a class="btn btn-sm btn-danger disabled"><i class="fas fa-trash"></i> Delete User</a><br />
|
|
<small>You cannot delete something that does not yet exist</small>
|
|
{% elif data['user']['superuser'] %}
|
|
<a class="btn btn-sm btn-danger disabled"><i class="fas fa-trash"></i> Delete User</a><br />
|
|
<small>You cannot delete a superuser</small>
|
|
{% else %}
|
|
<a href="/panel/remove_user?id={{ data['user']['user_id'] }}" class="btn btn-sm btn-danger"><i class="fas fa-trash"></i> Delete User</a>
|
|
{% end %}
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
</div>
|
|
<!-- content-wrapper ends -->
|
|
|
|
{% end %}
|
|
|
|
{% block js %}
|
|
<script>
|
|
|
|
|
|
//used to get cookies from browser - this is part of tornados xsrf protection - it's for extra security
|
|
function getCookie(name) {
|
|
var r = document.cookie.match("\\b" + name + "=([^;]*)\\b");
|
|
return r ? r[1] : undefined;
|
|
}
|
|
|
|
$( document ).ready(function() {
|
|
console.log( "ready!" );
|
|
|
|
});
|
|
|
|
|
|
</script>
|
|
|
|
{% end %} |