7262aee63d
New /settings page (linked from the header's burger menu) offers: - CSV export of the user's links, for spreadsheet apps. - SQL dump export as INSERT INTO links (...) statements, scoped to the current user only — never a raw full-database dump, since that would leak other accounts' password hashes and data. Embeddings are excluded (regenerated via "KI neu beschreiben lassen" if needed). - SQL import that re-adds a previously exported dump to the current account (additive, doesn't touch existing links). Import safety (app/backup.py): uploaded SQL is never executed against the real database. Each non-comment line is required to start with "insert into links" and is run one statement at a time against an isolated in-memory SQLite database with only a whitelisted `links` schema (no id/user_id columns) — sqlite3.execute() also rejects multiple statements per call. Only after that succeeds are rows copied into the real DB via the ORM, with user_id forced to the logged-in user. Verified this rejects DROP TABLE, ATTACH DATABASE, stacked statements, cross-table subqueries, and user_id injection. Upload is capped at 2 MB. Also adds download/upload icons and a proper file-input styling pattern (visually-hidden input + <label> trigger + filename readout), since the browser's ::file-selector-button pseudo-element didn't render reliably in testing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
85 lines
3.7 KiB
HTML
85 lines
3.7 KiB
HTML
{% extends "base.html" %}
|
||
{% import "_icons.html" as icons %}
|
||
{% block title %}Einstellungen · LinkVault{% endblock %}
|
||
{% block body %}
|
||
<header class="topbar">
|
||
<a href="/" class="brand">Link<span>Vault</span></a>
|
||
<div class="user-info">
|
||
<button id="theme-toggle" type="button" class="ghost icon-btn" title="Farbschema wechseln">
|
||
<span class="theme-icon-dark">{{ icons.moon() }}</span>
|
||
<span class="theme-icon-light">{{ icons.sun() }}</span>
|
||
</button>
|
||
<a href="/" class="ghost icon-btn" title="Zurück zu den Links">{{ icons.grid() }}</a>
|
||
</div>
|
||
</header>
|
||
|
||
<div class="layout" style="max-width:720px; margin-left:auto; margin-right:auto;">
|
||
<main class="main">
|
||
<h1 style="margin-top:0;">Einstellungen</h1>
|
||
<p class="muted" style="margin-top:-8px;">
|
||
Angemeldet als {{ user.email }} · {{ link_count }} Link{{ '' if link_count == 1 else 'e' }}
|
||
</p>
|
||
|
||
{% if imported is not none %}
|
||
<div class="panel" style="border-color:#16a34a;">
|
||
{{ icons.sparkles(size=15) }} {{ imported }} Link{{ '' if imported == '1' else 'e' }} erfolgreich importiert.
|
||
</div>
|
||
{% endif %}
|
||
{% if import_error %}
|
||
<div class="error">{{ import_error }}</div>
|
||
{% endif %}
|
||
|
||
<div class="panel">
|
||
<h2 style="margin-top:0; font-size:1.05rem;">CSV-Export</h2>
|
||
<p class="muted">
|
||
Alle deine Links als CSV-Tabelle (Titel, Zusammenfassung, Kategorie,
|
||
Hersteller, Tags, Datum) – zum Öffnen in Excel/Numbers/Sheets.
|
||
</p>
|
||
<a href="/settings/export.csv"><button type="button">{{ icons.download(size=14) }} CSV herunterladen</button></a>
|
||
</div>
|
||
|
||
<div class="panel">
|
||
<h2 style="margin-top:0; font-size:1.05rem;">Datenbank-Export (SQL-Dump)</h2>
|
||
<p class="muted">
|
||
Alle deine Links als SQL-<code>INSERT</code>-Anweisungen – als Backup
|
||
oder zum späteren Wiedereinspielen über den SQL-Import unten.
|
||
Enthält keine Embeddings (semantische Suche wird beim nächsten
|
||
„KI neu beschreiben lassen" pro Link neu erzeugt).
|
||
</p>
|
||
<a href="/settings/export.sql"><button type="button">{{ icons.download(size=14) }} SQL-Dump herunterladen</button></a>
|
||
</div>
|
||
|
||
<div class="panel">
|
||
<h2 style="margin-top:0; font-size:1.05rem;">SQL-Import</h2>
|
||
<p class="muted">
|
||
Eine mit obigem SQL-Export erzeugte Datei wieder einspielen. Die
|
||
Links werden deinem Konto <strong>hinzugefügt</strong> (keine
|
||
bestehenden Links werden überschrieben oder gelöscht). Nur Dateien,
|
||
die dem Export-Format dieser App entsprechen, werden akzeptiert
|
||
(max. 2 MB).
|
||
</p>
|
||
<form method="post" action="/settings/import-sql" enctype="multipart/form-data"
|
||
style="display:flex; gap:12px; flex-wrap:wrap; align-items:center;">
|
||
<input type="file" name="file" id="sql-import-file" accept=".sql,text/plain" required class="file-input">
|
||
<label for="sql-import-file" class="ghost file-label" style="padding:9px 16px; border-radius:8px; border:1px solid var(--border);">
|
||
{{ icons.upload(size=14) }} Datei wählen
|
||
</label>
|
||
<span id="sql-import-filename" class="muted" style="font-size:.85rem;">Keine Datei ausgewählt</span>
|
||
<button type="submit" style="margin-left:auto;">Importieren</button>
|
||
</form>
|
||
</div>
|
||
</main>
|
||
</div>
|
||
<script>
|
||
(function () {
|
||
var input = document.getElementById('sql-import-file');
|
||
var label = document.getElementById('sql-import-filename');
|
||
if (input && label) {
|
||
input.addEventListener('change', function () {
|
||
label.textContent = input.files && input.files[0] ? input.files[0].name : 'Keine Datei ausgewählt';
|
||
});
|
||
}
|
||
})();
|
||
</script>
|
||
{% endblock %}
|