- nginx: add X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy headers on all responses; rate limit /api/auth/login to 5 req/min per IP (burst 3) to prevent brute force - frontend: add escHtml() utility to api.js; use it on all notes fields across dashboard, log, history, flock, and budget pages to prevent XSS - log.js: fix broken loadRecent() call referencing removed #recent-body element; replaced with loadHistory() from history.js - schemas.py: raise minimum password length from 6 to 10 characters - admin.py: add audit logging for password reset, disable, delete, and impersonate actions; fix impersonate to use named admin param for logging - main.py: add startup env validation — exits with clear error if any required env var is missing; configure structured logging to stdout - docker-compose.yml: add log rotation (10 MB / 3 files) to all services Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
28 lines
879 B
JavaScript
28 lines
879 B
JavaScript
document.addEventListener('DOMContentLoaded', () => {
|
|
const form = document.getElementById('log-form');
|
|
const msg = document.getElementById('msg');
|
|
|
|
// Default date to today
|
|
setToday(document.getElementById('date'));
|
|
|
|
form.addEventListener('submit', async (e) => {
|
|
e.preventDefault();
|
|
|
|
const data = {
|
|
date: document.getElementById('date').value,
|
|
eggs: parseInt(document.getElementById('eggs').value, 10),
|
|
notes: document.getElementById('notes').value.trim() || null,
|
|
};
|
|
|
|
try {
|
|
await API.post('/api/eggs', data);
|
|
showMessage(msg, 'Entry saved!');
|
|
form.reset();
|
|
setToday(document.getElementById('date'));
|
|
loadHistory();
|
|
} catch (err) {
|
|
showMessage(msg, `Error: ${err.message}`, 'error');
|
|
}
|
|
});
|
|
});
|