No description
Find a file
rene 65cfa25e59 Security: CSP gehärtet — unsafe-inline + unsafe-eval raus, SW by-v1100
Inline-Scripts extrahiert:
- boot-early.js: Theme + theme-color (synchron im <head>, VOR CSS)
- boot.js: Offline-Banner + Service-Worker-Registration + Update-Flow
- landing-init.js: Dark-mode + Scroll-Animationen + Live-Stats +
  Stay-In-App-Handler + Details-Toggle

Inline onclick-Handler in landing.html:
- 5× sessionStorage.setItem('by_stay_in_app','1') → data-stay-in-app
- 1× Details-Toggle → data-toggle-target + data-toggle-text-open
- JS-Handler in landing-init.js binden die data-Attribute

CSP-Header (main.py):
- script-src: 'unsafe-inline' und 'unsafe-eval' entfernt
- style-src 'unsafe-inline' bleibt (Inline-Styles bleiben für jetzt,
  zu viele Fundstellen)
- Umami bleibt whitelisted

SW STATIC_ASSETS erweitert um boot-early.js + boot.js.
make bump aktualisiert jetzt auch landing.html ?v= Anker.
Tests grün (19/19).
2026-05-27 06:23:47 +02:00
backend Security: CSP gehärtet — unsafe-inline + unsafe-eval raus, SW by-v1100 2026-05-27 06:23:47 +02:00
diary Sprint 15: Suche, Ausweis, Teilen, Widget 2026-04-17 15:51:09 +02:00
promotion Dateien nach „promotion“ hochladen 2026-04-28 08:32:31 +02:00
reports Reports 2026-05-01 — Quartalsbericht 2026-05-01 08:07:41 +02:00
scripts Feature: Generische Seiten-Hilfe (UI.pageInfo), POI Multi-Select, Tagessprüche-DB (SW by-v654) 2026-05-03 20:10:01 +02:00
tests Big Sweep: Security + Race-Conditions + Tests + DSGVO + A11y, SW by-v1095 2026-05-26 20:12:01 +02:00
.env.example ki: Port 11435, Modell gemma-4-31b-it (LM Studio 0.4.x) 2026-04-24 18:15:32 +02:00
.gitignore Security: Play Store Paket aus Git entfernen (signing.keystore nicht eincheckbar) 2026-05-09 18:10:13 +02:00
docker-compose.staging.yml Fix: Storno sendet PDF+Mail+Scaninput; /scaninput Volume in staging ergänzt 2026-05-15 11:18:48 +02:00
docker-compose.yml Feature: Rechnungs-System (invoices) — Backend komplett 2026-05-15 10:04:23 +02:00
Dockerfile Fix: VERSION-Datei ins Docker-Image kopieren, SW by-v1096 2026-05-26 20:13:35 +02:00
Makefile Security: CSP gehärtet — unsafe-inline + unsafe-eval raus, SW by-v1100 2026-05-27 06:23:47 +02:00
PROJEKT.md Doku: Sprint 16 komplett — Phone-Frame, Screenshots, UX-Fixes 2026-04-27 19:44:26 +02:00
pytest.ini Big Sweep: Security + Race-Conditions + Tests + DSGVO + A11y, SW by-v1095 2026-05-26 20:12:01 +02:00
VERSION Security: CSP gehärtet — unsafe-inline + unsafe-eval raus, SW by-v1100 2026-05-27 06:23:47 +02:00