fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
c364e2b46d51c795b8ff1fa61ccb6251842e0064
breadcrumb-the-shire/templates/default.phtml

97 lines
4.0 KiB
PHTML
Raw Normal View History

baseline
2026-02-04 23:31:53 +01:00
<?php
use MintyPHP\Buffer;
agent foundation
2026-03-06 00:44:52 +01:00
use MintyPHP\Http\RequestContext;
use MintyPHP\Session;
baseline
2026-02-04 23:31:53 +01:00
$defaultTitle = appTitle();
$user = $_SESSION['user'] ?? [];
big restructure
2026-02-11 19:28:12 +01:00
$theme = currentTheme();
baseline
2026-02-04 23:31:53 +01:00
$primaryVars = appPrimaryCssVars();
agent foundation
2026-03-06 00:44:52 +01:00
$csrfKey = Session::$csrfSessionKey;
$csrfToken = (string) ($_SESSION[$csrfKey] ?? '');
feat(session): preserve intended URL across session timeout and add expiry warning dialog When a session expires, the user's current URL is now captured and restored after re-authentication (via remember-me cookie or manual login), instead of always redirecting to the dashboard. A JavaScript session warning dialog appears ~2 minutes before idle timeout, allowing users to extend their session with a single click. Includes open-redirect prevention via URL validation, Microsoft SSO callback support, and 33 unit tests. Refs: SESSION-REDIRECT-PRESERVE-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 14:28:49 +01:00
$isLoggedIn = !empty($user['id']);
settings cache
2026-03-13 14:38:58 +01:00
$sessionIdleMinutes = (int) (appSetting('session_idle_timeout_minutes') ?? 30);
$sessionIdleSeconds = max($sessionIdleMinutes, 5) * 60;
agent foundation
2026-03-06 00:44:52 +01:00
$telemetryEnabled = frontendTelemetryEnabled();
$telemetrySampleRate = frontendTelemetrySampleRate();
$telemetryAllowedEvents = implode(',', frontendTelemetryAllowedEvents());
$telemetryUrl = lurl('admin/frontend-telemetry/ingest');
$pageRequestId = RequestContext::id();
major update
2026-03-04 15:56:58 +01:00
$viewAuth = is_array($viewAuth ?? null) ? $viewAuth : [];
$viewAuth['layout'] = is_array($viewAuth['layout'] ?? null) ? $viewAuth['layout'] : [];
big restructure
2026-02-11 19:28:12 +01:00
$pageTitle = $defaultTitle;
ob_start();
Buffer::get('title');
$bufferTitle = trim((string) ob_get_clean());
if ($bufferTitle !== '') {
$pageTitle = $bufferTitle . ' - ' . $defaultTitle;
baseline
2026-02-04 23:31:53 +01:00
}
?>
<!DOCTYPE html>
agent foundation
2026-03-06 00:44:52 +01:00
<html
data-theme="<?php e($theme); ?>"
data-contrast="normal"
data-asset-base="<?php e(asset('')); ?>"
data-request-id="<?php e($pageRequestId); ?>"
data-telemetry-url="<?php e($telemetryUrl); ?>"
data-telemetry-enabled="<?php e($telemetryEnabled ? '1' : '0'); ?>"
data-telemetry-sample-rate="<?php e((string) $telemetrySampleRate); ?>"
data-telemetry-allowed-events="<?php e($telemetryAllowedEvents); ?>"
fix(session): preserve intended URL across session timeout with remember-me Session timeout redirected to /de/login?return_to=... but the remember-me cookie was not cleared by logoutDueToSessionTimeout(). On the next request, autoLoginFromCookie() silently re-logged the user in, causing the MintyPHP router to resolve the login route to pages/index().php (dashboard) instead of the login action — the intended URL redirect logic never executed. Fix: intercept ?return_to= immediately after successful auto-login in index.php and redirect to the sanitized route path. Also harden the login flow with hidden return_to form fields and POST body fallback for cases without remember-me. Additional improvements in this commit: - Convert stored REQUEST_URI to router-compatible path (strip leading slash and locale prefix) via IntendedUrlService::toRoutePath() - Consolidate duplicate CSRF data attributes into shared data-csrf-key and data-csrf-token on <html> element - Add tenant branding (logo) to auth pages via appAuthLogoUrl() helper Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 18:28:13 +01:00
data-csrf-key="<?php e($csrfKey); ?>"
data-csrf-token="<?php e($csrfToken); ?>"
settings cache
2026-03-13 14:38:58 +01:00
<?php if ($isLoggedIn): ?>
feat(session): preserve intended URL across session timeout and add expiry warning dialog When a session expires, the user's current URL is now captured and restored after re-authentication (via remember-me cookie or manual login), instead of always redirecting to the dashboard. A JavaScript session warning dialog appears ~2 minutes before idle timeout, allowing users to extend their session with a single click. Includes open-redirect prevention via URL validation, Microsoft SSO callback support, and 33 unit tests. Refs: SESSION-REDIRECT-PRESERVE-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 14:28:49 +01:00
data-session-idle-seconds="<?php e((string) $sessionIdleSeconds); ?>"
data-session-ping-url="<?php e(lurl('admin/session-ping/data')); ?>"
data-session-logout-url="<?php e(lurl('logout')); ?>"
<?php endif; ?>
agent foundation
2026-03-06 00:44:52 +01:00
class="no-js"
<?php if ($primaryVars !== ''): ?>style="<?php e($primaryVars); ?>" <?php endif; ?>
>
baseline
2026-02-04 23:31:53 +01:00
<head>
Repo Interface für tests
2026-03-05 08:26:51 +01:00
<script src="<?php e(assetVersion('js/app-boot.js')); ?>"></script>
baseline
2026-02-04 23:31:53 +01:00
<base href="<?php e(localeBase()); ?>">
big restructure
2026-02-11 19:28:12 +01:00
<title><?php e($pageTitle); ?></title>
baseline
2026-02-04 23:31:53 +01:00
<meta property="og:site_name" content="<?php e($defaultTitle); ?>">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="icon" type="image/png" sizes="32x32" href="<?php e(appFaviconUrl('favicon-32x32.png')); ?>">
<link rel="icon" type="image/png" sizes="16x16" href="<?php e(appFaviconUrl('favicon-16x16.png')); ?>">
<link rel="apple-touch-icon" href="<?php e(appFaviconUrl('apple-touch-icon.png')); ?>">
<link rel="manifest" href="<?php e(asset('favicon/site.webmanifest')); ?>">
add composer-unused, comprehensive docs, and project restructure - Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks - Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists - Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services - Add Microsoft OIDC SSO, API token management, and user lifecycle features - Add swagger-ui vendor integration and OpenAPI spec - Add production Docker setup and bin/ scripts - Update composer dependencies, config, templates, and frontend assets throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-22 15:27:35 +01:00
<?php renderTemplateStyles('default'); ?>
<?php renderPageStyles(); ?>
baseline
2026-02-04 23:31:53 +01:00
</head>
<body>
topbar anpassungen
2026-03-05 12:51:53 +01:00
<a class="app-skip-link" href="#app-main-content"><?php e(t('Skip to main content')); ?></a>
baseline
2026-02-04 23:31:53 +01:00
<div class="app-container">
add composer-unused, comprehensive docs, and project restructure - Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks - Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists - Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services - Add Microsoft OIDC SSO, API token management, and user lifecycle features - Add swagger-ui vendor integration and OpenAPI spec - Add production Docker setup and bin/ scripts - Update composer dependencies, config, templates, and frontend assets throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-22 15:27:35 +01:00
<?php require __DIR__ . '/partials/app-main-aside-icon-bar.phtml'; ?>
<?php require __DIR__ . '/partials/app-main-aside.phtml'; ?>
baseline
2026-02-04 23:31:53 +01:00
<div class="app-main">
<main>
add composer-unused, comprehensive docs, and project restructure - Add icanhazstring/composer-unused as dev dependency for dependency hygiene checks - Add German documentation (docs/) covering architecture, conventions, workflows, and developer checklists - Add API layer (ApiAuth, ApiBootstrap, ApiResponse), audit, scheduler, custom fields, and SSO services - Add Microsoft OIDC SSO, API token management, and user lifecycle features - Add swagger-ui vendor integration and OpenAPI spec - Add production Docker setup and bin/ scripts - Update composer dependencies, config, templates, and frontend assets throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-22 15:27:35 +01:00
<?php require __DIR__ . '/partials/app-topbar.phtml'; ?>
topbar anpassungen
2026-03-05 12:51:53 +01:00
<div id="app-main-content" class="app-main-content" tabindex="-1">
baseline
2026-02-04 23:31:53 +01:00
<?php require __DIR__ . '/partials/app-flash.phtml'; ?>
<?php Buffer::get('html'); ?>
</div>
</main>
<?php require __DIR__ . '/partials/app-footer.phtml'; ?>
</div>
</div>
Repo Interface für tests
2026-03-05 08:26:51 +01:00
<script src="<?php e(assetVersion('vendor/fslightbox/fslightbox.js')); ?>"></script>
agent foundation
2026-03-06 00:44:52 +01:00
<?php require __DIR__ . '/partials/app-confirm-dialog.phtml'; ?>
settings cache
2026-03-13 14:38:58 +01:00
<?php if ($isLoggedIn): ?>
feat(session): preserve intended URL across session timeout and add expiry warning dialog When a session expires, the user's current URL is now captured and restored after re-authentication (via remember-me cookie or manual login), instead of always redirecting to the dashboard. A JavaScript session warning dialog appears ~2 minutes before idle timeout, allowing users to extend their session with a single click. Includes open-redirect prevention via URL validation, Microsoft SSO callback support, and 33 unit tests. Refs: SESSION-REDIRECT-PRESERVE-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 14:28:49 +01:00
<?php require __DIR__ . '/partials/app-session-warning-dialog.phtml'; ?>
Global Boomarks
2026-03-14 21:45:58 +01:00
<?php require __DIR__ . '/partials/app-bookmark-dialog.phtml'; ?>
feat(session): preserve intended URL across session timeout and add expiry warning dialog When a session expires, the user's current URL is now captured and restored after re-authentication (via remember-me cookie or manual login), instead of always redirecting to the dashboard. A JavaScript session warning dialog appears ~2 minutes before idle timeout, allowing users to extend their session with a single click. Includes open-redirect prevention via URL validation, Microsoft SSO callback support, and 33 unit tests. Refs: SESSION-REDIRECT-PRESERVE-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 14:28:49 +01:00
<script type="module" src="<?php e(assetVersion('js/components/app-session-warning.js')); ?>"></script>
Global Boomarks
2026-03-14 21:45:58 +01:00
<script type="module" src="<?php e(assetVersion('js/components/app-bookmark-init.js')); ?>"></script>
feat(session): preserve intended URL across session timeout and add expiry warning dialog When a session expires, the user's current URL is now captured and restored after re-authentication (via remember-me cookie or manual login), instead of always redirecting to the dashboard. A JavaScript session warning dialog appears ~2 minutes before idle timeout, allowing users to extend their session with a single click. Includes open-redirect prevention via URL validation, Microsoft SSO callback support, and 33 unit tests. Refs: SESSION-REDIRECT-PRESERVE-001 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 14:28:49 +01:00
<?php endif; ?>
big restructure
2026-02-11 19:28:12 +01:00
<script type="module" src="<?php e(assetVersion('js/app-init.js')); ?>"></script>
baseline
2026-02-04 23:31:53 +01:00
</body>
major update
2026-03-04 15:56:58 +01:00
</html>
Reference in New Issue Copy Permalink