Alec Perkins
99f810d043
- Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
20 lines
832 B
HTML
20 lines
832 B
HTML
{% extends "base.html" %}
|
|
|
|
{% block title %}Invitation to {{ invite.org.name }} · Intent{% endblock %}
|
|
|
|
{% block content %}
|
|
<h1>Join {{ invite.org.name }}</h1>
|
|
{% if invite.is_open %}
|
|
<p>
|
|
{% if invite.invited_by %}{{ invite.invited_by.username }} invited you{% else %}You're invited{% endif %}
|
|
to join as {{ invite.get_role_display|lower }}. You'll join as <strong>{{ user.username }}</strong>.
|
|
</p>
|
|
<form method="post" action="{% url 'invites:respond' invite_id=invite.pk %}">
|
|
{% csrf_token %}
|
|
<button type="submit" name="action" value="accept">Accept</button>
|
|
<button type="submit" name="action" value="decline">Decline</button>
|
|
</form>
|
|
{% else %}
|
|
<p>This invitation is no longer valid. Ask an owner of {{ invite.org.name }} for a new one.</p>
|
|
{% endif %}
|
|
{% endblock %}
|