Secure image access and bootstrap admin

assets/js/admin.js

@@ -27,32 +27,42 @@ $(document).ready(function() {
             $('#user-select').html('<option value="">Nutzer waehlen...</option>');
 
             users.forEach(function(u) {
-                var badge = '<span class="badge badge-' + u.role + '">' + u.role + '</span>';
+                var badge = $('<span></span>').addClass('badge badge-' + u.role).text(u.role);
                 var created = u.created_at ? new Date(u.created_at).toLocaleDateString('de-DE') : '-';
                 var info = created;
 
                 if (u.role === 'client' && u.expires_at) {
                     var expDate = new Date(u.expires_at).toLocaleDateString('de-DE');
                     if (u.expired) {
-                        badge = '<span class="badge badge-expired">abgelaufen</span>';
+                        badge = $('<span></span>').addClass('badge badge-expired').text('abgelaufen');
                         info = 'Abgelaufen: ' + expDate;
                     } else {
                         info = 'Bis: ' + expDate;
                     }
                 }
 
-                var actions = '<button class="btn-small" onclick="changePassword(' + u.id + ', \'' + u.username.replace(/'/g, "\\'") + '\')">PW</button>';
-                actions += '<button class="btn-small" onclick="deleteUser(' + u.id + ', \'' + u.username.replace(/'/g, "\\'") + '\')">X</button>';
+                var row = $('<tr></tr>');
+                var userCell = $('<td></td>').text(u.username + ' ').append(badge);
+                var actions = $('<td></td>');
+                $('<button type="button" class="btn-small user-password">PW</button>')
+                    .data('user-id', u.id)
+                    .data('username', u.username)
+                    .appendTo(actions);
+                $('<button type="button" class="btn-small user-delete">X</button>')
+                    .data('user-id', u.id)
+                    .data('username', u.username)
+                    .appendTo(actions);
 
-                $('#users-tbody').append(
-                    '<tr><td>' + u.id + '</td><td>' + u.username + ' ' + badge +
-                    '</td><td>' + u.role + '</td><td>' + info +
-                    '</td><td>' + actions + '</td></tr>'
-                );
+                row.append($('<td></td>').text(u.id));
+                row.append(userCell);
+                row.append($('<td></td>').text(u.role));
+                row.append($('<td></td>').text(info));
+                row.append(actions);
+                $('#users-tbody').append(row);
 
                 // Dropdown fuer Ordner-Zuweisung (nur non-admin)
                 if (u.role !== 'admin') {
-                    $('#user-select').append('<option value="' + u.id + '">' + u.username + ' (' + u.role + ')</option>');
+                    $('#user-select').append($('<option></option>').val(u.id).text(u.username + ' (' + u.role + ')'));
                 }
             });
         });
@@ -75,16 +85,20 @@ $(document).ready(function() {
     });
 
     // Nutzer loeschen
-    window.deleteUser = function(id, name) {
+    function deleteUser(id, name) {
         if (confirm('Nutzer "' + name + '" wirklich loeschen?')) {
             $.ajax({ url: '/api/admin/users/' + id, type: 'DELETE' })
              .done(loadUsers)
              .fail(function(err) { alert(err.responseJSON ? err.responseJSON.error : 'Fehler'); });
         }
-    };
+    }
+
+    $('#users-tbody').on('click', '.user-delete', function() {
+        deleteUser($(this).data('user-id'), $(this).data('username'));
+    });
 
     // Passwort aendern (Admin setzt fuer anderen User)
-    window.changePassword = function(id, name) {
+    function changePassword(id, name) {
         var newPw = prompt('Neues Passwort fuer "' + name + '":');
         if (!newPw) return;
         $.ajax({
@@ -97,7 +111,11 @@ $(document).ready(function() {
         }).fail(function(err) {
             alert(err.responseJSON ? err.responseJSON.error : 'Fehler');
         });
-    };
+    }
+
+    $('#users-tbody').on('click', '.user-password', function() {
+        changePassword($(this).data('user-id'), $(this).data('username'));
+    });
 
     // ==================== ORDNER-ZUWEISUNG ====================
 
@@ -109,12 +127,14 @@ $(document).ready(function() {
                 return;
             }
             folders.forEach(function(f) {
-                $('#folder-checkboxes').append(
-                    '<div class="folder-check"><label>' +
-                    '<input type="checkbox" value="' + f + '" class="folder-cb"/> ' +
-                    '<i class="fa fa-folder"></i> ' + f +
-                    '</label></div>'
-                );
+                var wrapper = $('<div class="folder-check"></div>');
+                var label = $('<label></label>');
+                $('<input type="checkbox" class="folder-cb"/>').val(f).appendTo(label);
+                label.append(' ');
+                $('<i class="fa fa-folder"></i>').appendTo(label);
+                label.append(' ' + f);
+                wrapper.append(label);
+                $('#folder-checkboxes').append(wrapper);
             });
         });
     }
@@ -126,7 +146,9 @@ $(document).ready(function() {
         if (!uid) return;
         $.get('/api/admin/assign?user_id=' + uid).done(function(assignedFolders) {
             assignedFolders.forEach(function(f) {
-                $('.folder-cb[value="' + f + '"]').prop('checked', true);
+                $('.folder-cb').filter(function() {
+                    return $(this).val() === f;
+                }).prop('checked', true);
             });
         });
     });