[java-idp-plugin-duo] branch main updated: Redo form and add Javascript to set focus and selection to username.

Tue Jan 9 14:08:54 UTC 2024

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=14455cc9744399de365b0575a21746b48c3c7db6

The following commit(s) were added to refs/heads/main by this push:
     new 14455cc9 Redo form and add Javascript to set focus and selection to username.
14455cc9 is described below

commit 14455cc9744399de365b0575a21746b48c3c7db6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 9 09:08:51 2024 -0500

    Redo form and add Javascript to set focus and selection to username.
---
 .../idp/plugin/authn/duo/views/passwordless.vm     | 32 +++++++++++++---------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
index 457a1890..6f0e73ba 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
@@ -23,8 +23,8 @@
 #if ($eventCtx)
 #set ($eventId = $eventCtx.getEvent())
 #end
-#set ($onClick = "document.password.j_username.value = document.passwordless.j_username.value")
-$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
+#set ($nonce = $cspNonce.generateIdentifier())
+$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
 ##
 <!DOCTYPE html>
 <html>
@@ -35,7 +35,7 @@ $response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes'
         <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0">
         <link rel="stylesheet" type="text/css" href="$request.getContextPath()#springMessageText("idp.css", "/css/placeholder.css")">
     </head>
-    <body>
+    <body onLoad="$onLoad">
         <main class="main">
             <header>
                 <img class="main-logo" src="$request.getContextPath()#springMessageText("idp.logo", "/images/placeholder-logo.png")" alt="#springMessageText("idp.logo.alt-text", "logo")" />
@@ -73,25 +73,21 @@ $response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes'
                 please enter your username below and press the corresponding button. To bypass this option, just press the alternate button
                 to perform a traditional login.")</blockquote>
 
-                <form name="password" action="$flowExecutionUrl" method="post">
+                <form action="$flowExecutionUrl" method="post">
                     #parse("csrf/csrf.vm")
-                    <input name="j_username" type="hidden" value="" />
                     <div class="grid">
                         <div class="grid-item">
-                            <button type="submit" name="_eventId_cancel" onClick="$onClick"
+                            <button type="button" name="_eventId_cancel"
                                 >#springMessageText("idp.duo.passwordless.cancel", "Login with Password")</button>
                         </div>
                     </div>
-                </form>
                     
-                #if ($eventId == "RequestUnsupported")
-                    <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
-                #end
+                    #if ($eventId == "RequestUnsupported")
+                        <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
+                    #end
                         
-                <form name="passwordless" action="$flowExecutionUrl" method="post">
-                    #parse("csrf/csrf.vm")
                     <label for="username">#springMessageText("idp.login.username", "Username")</label>
-                    <input name="j_username" type="text"
+                    <input id="j_username" name="j_username" type="text"
                         value="#if($username)$encoder.encodeForHTML($username)#end" />
                         
                     <input type="checkbox" name="donotcache" value="1" id="donotcache" />
@@ -119,5 +115,15 @@ $response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes'
                 <p>#springMessageText("idp.footer", "Insert your footer text here.")</p>
             </div>
         </footer>
+        
+        <script #if ($nonce)nonce="$nonce"#end>
+        <!--
+        const input = document.getElementById('j_username');
+        const end = input.value.length;
+        input.setSelectionRange(end, end);
+        input.focus();
+        // -->
+        </script>
+        
      </body>
 </html>
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
