fs
ad8f30cb09
Eliminate all inline scripts to enable script-src 'self' without 'unsafe-inline', providing strong XSS mitigation via CSP. Inline script removal: - login.phtml: replace inline APP_ASSET_BASE with data-asset-base attribute + app-boot.js (matching default.phtml pattern) - api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js - docs: extract checkbox enablement to js/pages/admin-docs-index.js - language-switcher: replace onchange handler with data-auto-submit attribute + js/components/app-auto-submit.js event listener CSP policy (dev + prod nginx): default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; manifest-src 'self' Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
74 lines
3.1 KiB
PHTML
74 lines
3.1 KiB
PHTML
<?php
|
|
|
|
/**
|
|
* @var string $renderedHtml Rendered markdown HTML
|
|
* @var array<int, array<string, mixed>> $tocItems TOC headings [{level, text, anchor}]
|
|
* @var array<string, array<string, string>> $docGroups Grouped doc navigation
|
|
* @var string $currentSlug Active slug
|
|
* @var string $currentTitle Active doc title
|
|
* @var string $defaultSlug Default docs slug from catalog order
|
|
*/
|
|
?>
|
|
|
|
<div class="app-docs-container">
|
|
|
|
<aside class="app-docs-nav" aria-label="<?php e(t('Documentation navigation')); ?>">
|
|
<nav data-details-storage="admin-docs-nav-groups-v1">
|
|
<?php $groupIndex = 0; ?>
|
|
<?php foreach ($docGroups as $groupLabel => $items): ?>
|
|
<?php
|
|
$groupKey = 'docs-nav-group-' . ((string) (array_key_first($items) ?? $groupIndex));
|
|
$groupOpen = array_key_exists($currentSlug, $items);
|
|
$groupIndex++;
|
|
?>
|
|
<div class="app-docs-nav-group">
|
|
<details data-details-key="<?php e($groupKey); ?>" <?php if ($groupOpen): ?>open<?php endif; ?>>
|
|
<summary><small class="muted"><?php e($groupLabel); ?></small></summary>
|
|
<ul>
|
|
<?php foreach ($items as $docSlug => $label): ?>
|
|
<?php $isActive = $docSlug === $currentSlug; ?>
|
|
<li>
|
|
<a href="<?php e(lurl('admin/docs/' . $docSlug)); ?>"
|
|
class="<?php e($isActive ? 'active' : ''); ?>"
|
|
<?php if ($isActive): ?>aria-current="page" <?php endif; ?>>
|
|
<?php e($label); ?>
|
|
</a>
|
|
</li>
|
|
<?php endforeach; ?>
|
|
</ul>
|
|
</details>
|
|
<hr>
|
|
</div>
|
|
<?php endforeach; ?>
|
|
</nav>
|
|
</aside>
|
|
|
|
<article class="app-docs-content">
|
|
<?php
|
|
$breadcrumbs = [
|
|
['label' => t('Home'), 'path' => 'admin'],
|
|
['label' => t('Documentation'), 'path' => 'admin/docs/' . $defaultSlug],
|
|
['label' => $currentTitle],
|
|
];
|
|
require templatePath('partials/app-breadcrumb.phtml');
|
|
?>
|
|
<?php MintyPHP\Buffer::get('docs_rendered_html'); ?>
|
|
</article>
|
|
|
|
<?php if ($tocItems): ?>
|
|
<aside class="app-docs-toc" aria-label="<?php e(t('On this page')); ?>">
|
|
<small class="muted"><?php e(t('On this page')); ?></small>
|
|
<ul>
|
|
<?php foreach ($tocItems as $item): ?>
|
|
<li class="app-docs-toc-level-<?php e((string) $item['level']); ?>">
|
|
<a href="<?php e(lurl('admin/docs/' . $currentSlug) . '#' . $item['anchor']); ?>"><?php e($item['text']); ?></a>
|
|
</li>
|
|
<?php endforeach; ?>
|
|
</ul>
|
|
</aside>
|
|
<?php endif; ?>
|
|
|
|
</div>
|
|
|
|
<script type="module" src="<?php e(assetVersion('js/pages/admin-docs-index.js')); ?>"></script>
|