FrankandClaude Sonnet 5
ba45e06972
Not exploitable today - the only custom auth message data is a hardcoded resend link - but |raw on a translated exception message is a latent XSS pattern if a future change ever threads user input through the auth exception's message data. Twig's default autoescaping is sufficient here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
2.0 KiB
Twig
54 lines
2.0 KiB
Twig
{% extends 'layout/auth.html.twig' %}
|
|
|
|
{% block title %}Log in{% endblock %}
|
|
|
|
{% block auth_body %}
|
|
<form method="post">
|
|
{% if error %}
|
|
<div class="alert alert-danger">
|
|
{{ error.messageKey|trans(error.messageData, 'security') }}
|
|
{% if error.messageData['%resend_link%'] is defined %}
|
|
<a href="{{ error.messageData['%resend_link%'] }}">Resend activation link</a>
|
|
{% endif %}
|
|
</div>
|
|
{% endif %}
|
|
|
|
{% if app.user %}
|
|
<div class="alert alert-info">
|
|
You are logged in as {{ app.user.userIdentifier }}, <a href="{{ path('app_logout') }}">Logout</a>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div class="mb-3">
|
|
<label for="inputUsername" class="form-label">Username</label>
|
|
<input type="text" value="{{ last_username }}" name="username" id="inputUsername" class="form-control" autocomplete="username" required autofocus>
|
|
</div>
|
|
<div class="mb-3">
|
|
<label for="inputPassword" class="form-label">Password</label>
|
|
<input type="password" name="password" id="inputPassword" class="form-control" autocomplete="current-password" required>
|
|
</div>
|
|
|
|
<input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
|
|
|
|
{#
|
|
Uncomment this section and add a remember_me option below your firewall to activate remember me functionality.
|
|
See https://symfony.com/doc/current/security/remember_me.html
|
|
|
|
<div class="form-check mb-3">
|
|
<input type="checkbox" class="form-check-input" id="rememberMe" name="_remember_me">
|
|
<label class="form-check-label" for="rememberMe">Remember me</label>
|
|
</div>
|
|
#}
|
|
|
|
<div class="d-grid">
|
|
<button class="btn btn-primary" type="submit">Sign in</button>
|
|
</div>
|
|
<div class="mt-3 text-center">
|
|
<a href="{{ path('app_forgot_password_request') }}">Forgot your password?</a>
|
|
</div>
|
|
<div class="mt-1 text-center">
|
|
<a href="{{ path('app_verify_resend_email') }}">Didn't receive activation email?</a>
|
|
</div>
|
|
</form>
|
|
{% endblock %}
|