fix : externaliser tous les scripts inline (CSP script-src 'self')

Tous les <script> inline et event handlers inline bloqués par la CSP sont déplacés vers des fichiers JS statiques servis par 'self' : - density-fouc.js : anti-FOUC densité (chargé en <head>) - density.js : widget L/M/S - trending-home.js : AJAX "Meilleures audiences" (RSS XML) - admin-stats.js : groupes AS + pages trending (RSS XML) - admin.js : bookAddArticle + bulk-delete (onclick/onchange → listeners) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-15 21:00:26 +02:00
parent 58a110d5b9
commit 3e856dc476
9 changed files with 199 additions and 157 deletions
@@ -0,0 +1,68 @@
+/* Admin stats : groupes AS + chargement pages via flux RSS XML /trending?period=14d */
+
+// ── Groupes de réseaux ────────────────────────────────────────────────────────
+(function () {
+    var addBtn = document.getElementById('as-group-add');
+    if (!addBtn) { return; }
+
+    addBtn.addEventListener('click', function () {
+        var tpl = document.getElementById('as-group-tpl').content.cloneNode(true);
+        document.getElementById('as-groups-list').appendChild(tpl);
+    });
+
+    document.getElementById('as-groups-list').addEventListener('click', function (e) {
+        if (e.target.classList.contains('as-group-delete')) {
+            e.target.closest('.as-group-row').remove();
+        }
+    });
+}());
+
+// ── Pages les plus visitées (RSS XML) ────────────────────────────────────────
+(function () {
+    var container = document.getElementById('stats-pages-container');
+    var badge     = document.getElementById('stats-pages-count');
+    if (!container) { return; }
+
+    function esc(s) {
+        return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+    }
+
+    fetch('/trending?period=14d')
+        .then(function (r) { return r.ok ? r.text() : Promise.reject(); })
+        .then(function (xml) {
+            var doc   = new DOMParser().parseFromString(xml, 'application/xml');
+            var items = Array.from(doc.querySelectorAll('item'));
+            if (!items.length) {
+                container.innerHTML = '<p class="text-muted p-3 mb-0">Aucune donnée.</p>';
+                return;
+            }
+            var rows = items.map(function (item) {
+                var raw   = (item.querySelector('title') || { textContent: '' }).textContent;
+                var link  = ((item.querySelector('link') || {}).textContent || '').trim();
+                var m     = raw.match(/\((\d+)\s+visiteurs?\)$/);
+                var vis   = m ? parseInt(m[1], 10) : 0;
+                var title = raw.replace(/\s*\(\d+\s+visiteurs?\)$/, '');
+                var slug  = decodeURIComponent(link.replace(/.*\/post\//, ''));
+                return { title: title, link: link, slug: slug, vis: vis };
+            });
+            var maxV = Math.max.apply(null, rows.map(function (r) { return r.vis; })) || 1;
+            var html = '<div class="table-responsive"><table class="table table-sm table-hover mb-0 small"><tbody>';
+            rows.forEach(function (row, i) {
+                var pct = Math.round(row.vis / maxV * 100);
+                var vis = row.vis.toLocaleString('fr-FR');
+                html += '<tr>'
+                    + '<td class="text-muted ps-3" style="width:2rem">' + (i + 1) + '</td>'
+                    + '<td><a href="' + esc(row.link) + '" target="_blank" class="text-decoration-none text-truncate d-block" style="max-width:260px" title="' + esc(row.slug) + '">'
+                    + esc(row.title || row.slug) + '</a>'
+                    + '<div class="progress mt-1" style="height:3px"><div class="progress-bar" style="width:' + pct + '%"></div></div></td>'
+                    + '<td class="text-end fw-semibold pe-3">' + vis + ' <span class="text-muted fw-normal">vis.</span></td>'
+                    + '</tr>';
+            });
+            html += '</tbody></table></div>';
+            if (badge) { badge.textContent = rows.length + ' URLs'; }
+            container.innerHTML = html;
+        })
+        .catch(function () {
+            container.innerHTML = '<p class="text-muted p-3 mb-0">Impossible de charger le flux.</p>';
+        });
+}());