FrankandClaude Sonnet 5
2913b8d2a2
The admin panel already checked CSRF tokens on destructive actions, but the player-facing raw HTML forms (create/join/leave/start session, toggle ready, lobby chat, feedback) had none - cookie SameSite=Lax blunts classic cross-site auto-submit attacks but isn't a substitute for real tokens. Adds matching csrf_token()/ isCsrfTokenValid() checks to all of them. Also adds login_throttling (5 attempts/15 min) to stop unlimited password guessing, and a per-user rate limiter (10/min) on the invite-code join endpoint, since invite codes are only 32-bit and had no protection against brute-forcing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
120 lines
6.2 KiB
Twig
120 lines
6.2 KiB
Twig
{% extends 'layout/site.html.twig' %}
|
|
|
|
{% block title %}Game Dashboard{% endblock %}
|
|
|
|
{% block body %}
|
|
<div class="d-flex justify-content-between align-items-center mb-4">
|
|
<h1 class="mb-0">Game Dashboard</h1>
|
|
{% if is_granted('ROLE_ADMIN') %}
|
|
<a href="{{ path('game_admin_dashboard') }}" class="btn btn-outline-secondary">Go to Game Admin Dashboard</a>
|
|
{% endif %}
|
|
</div>
|
|
|
|
<div class="row g-4 mb-4">
|
|
<div class="col-md-6">
|
|
<div class="card h-100">
|
|
<div class="card-header bg-secondary text-white">Create New Session</div>
|
|
<div class="card-body">
|
|
{% if availableGames is not empty %}
|
|
<form method="post">
|
|
<input type="hidden" name="_token" value="{{ csrf_token('create_session') }}">
|
|
<select name="game_id" class="form-select mb-3">
|
|
{% for game in availableGames %}
|
|
<option value="{{ game.id }}">
|
|
{{ game.name }} ({{ game.numberOfPlayers }} players)
|
|
{% if is_granted('ROLE_ADMIN') %}
|
|
[{{ game.status.value }}]
|
|
{% endif %}
|
|
</option>
|
|
{% endfor %}
|
|
</select>
|
|
<button type="submit" name="create_session" class="btn btn-primary">Create Session</button>
|
|
</form>
|
|
{% else %}
|
|
<p class="text-muted mb-0">No games available to start.</p>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="col-md-6">
|
|
<div class="card h-100">
|
|
<div class="card-header bg-secondary text-white">Join Session</div>
|
|
<div class="card-body">
|
|
<form method="post" class="d-flex gap-2">
|
|
<input type="hidden" name="_token" value="{{ csrf_token('join_session') }}">
|
|
<input type="text" name="invite_code" class="form-control" placeholder="Enter Invite Code" required>
|
|
<button type="submit" name="join_session" class="btn btn-primary text-nowrap">Join Session</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<h2 class="h4">Your Sessions</h2>
|
|
{% if sessions is not empty %}
|
|
<div class="table-responsive">
|
|
<table class="table table-striped align-middle">
|
|
<thead>
|
|
<tr>
|
|
<th>ID</th>
|
|
<th>Game</th>
|
|
<th>Status</th>
|
|
<th>Created At</th>
|
|
<th>Invite Code</th>
|
|
<th>Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for session in sessions %}
|
|
<tr>
|
|
<td>{{ session.id }}</td>
|
|
<td>{{ session.game.name }}</td>
|
|
<td><span class="badge bg-info text-dark">{{ session.status.label }}</span></td>
|
|
<td>{{ session.created|date('Y-m-d H:i') }}</td>
|
|
<td>
|
|
{% set inviteCode = '' %}
|
|
{% for setting in session.settings %}
|
|
{% if setting.name.value == 'InviteCode' %}
|
|
{% set inviteCode = setting.value %}
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
{% if inviteCode %}
|
|
<code>{{ inviteCode }}</code>
|
|
{% else %}
|
|
<form method="post" class="d-inline">
|
|
<input type="hidden" name="_token" value="{{ csrf_token('create_invite_' ~ session.id) }}">
|
|
<input type="hidden" name="session_id" value="{{ session.id }}">
|
|
<button type="submit" name="create_invite" class="btn btn-sm btn-outline-secondary">Generate Invite</button>
|
|
</form>
|
|
{% endif %}
|
|
</td>
|
|
<td>
|
|
<a href="{{ path('game', {session: session.id}) }}" class="btn btn-sm btn-primary">Enter Game</a>
|
|
{% if session.status.value == 'created' %}
|
|
{% if session.players|length >= session.game.numberOfPlayers %}
|
|
<form method="post" class="d-inline">
|
|
<input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
|
|
<input type="hidden" name="session_id" value="{{ session.id }}">
|
|
<button type="submit" name="start_session" class="btn btn-sm btn-success">Start Session</button>
|
|
</form>
|
|
{% endif %}
|
|
{% if session.timer == 0 %}
|
|
<form method="post" class="d-inline">
|
|
<input type="hidden" name="_token" value="{{ csrf_token('leave_session_' ~ session.id) }}">
|
|
<input type="hidden" name="session_id" value="{{ session.id }}">
|
|
<button type="submit" name="leave_session" class="btn btn-sm btn-outline-danger" onclick="return confirm('Are you sure you want to leave this session?')">Leave Session</button>
|
|
</form>
|
|
{% endif %}
|
|
{% endif %}
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% else %}
|
|
<p class="text-muted">You are not part of any sessions.</p>
|
|
{% endif %}
|
|
{% endblock %}
|