fix(frontend): #37 punti 1,4,5,6 - 502 backend giù, barcode quotato, apici Alpine, paginazione ricette

1. api_client.py: ConnectionError/Timeout restituisce status_code=502 invece di 0 (nessuna route confrontava == 0, verificato); i proxy che inoltrano resp.get("status_code", 500) ereditano il fix senza altre modifiche. 4. measure.py lookup_barcode: code non stringa -> 400 (prima 500 su code.strip()); urllib.parse.quote(code, safe="") prima di comporre l'URL verso il backend - un barcode con '/' o '../' non spezza più il path né raggiunge altri GET con i permessi dell'utente. 5. Ogni "'{{ _(...) }}'" dentro un attributo Alpine (x-text, :title, :placeholder, @click) sostituito con "{{ _(...)|tojson_attr }}": la traduzione EN di admin/stations.html:105 ("Clear the station's recipes") ha un apostrofo che l'IT non ha, e rompeva quel binding e basta - non è un XSS, ma stessa classe di difetto di #10. File toccati: admin/stations, admin/users, maker/recipe_list, maker/recipe_editor, maker/task_editor, maker/task_drawing, components/caliper_status, measure/select_recipe. Le occorrenze dentro <script>...</script> (non attributi) sono fuori perimetro per questo punto. 6. statistics.py dashboard(): ciclo sulle pagine (per_page=100, il massimo del backend) invece di un'unica chiamata che troncava la tendina ricette alla centesima. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-21 23:03:06 +02:00
parent c0583da478
commit 72f0cb1f1b
15 changed files with 218 additions and 50 deletions
@@ -86,13 +86,13 @@
                      :class="station.active
                        ? 'bg-emerald-100 dark:bg-emerald-900/30 text-emerald-700 dark:text-emerald-300'
                        : 'bg-red-100 dark:bg-red-900/30 text-red-700 dark:text-red-300'"
-                      x-text="station.active ? '{{ _('Attiva') }}' : '{{ _('Disattivata') }}'"></span>
+                      x-text="station.active ? {{ _('Attiva')|tojson_attr }} : {{ _('Disattivata')|tojson_attr }}"></span>
              </td>
              <td class="px-4 py-3 text-right" @click.stop>
                <div class="flex items-center justify-end gap-1">
                  <button @click="openAssignmentsModal(station)"
                          class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-primary hover:bg-primary-50 dark:hover:bg-primary-900/20 transition-colors"
-                          :title="'{{ _('Gestisci ricette') }}'">
+                          :title="{{ _('Gestisci ricette')|tojson_attr }}">
                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4"/>
                    </svg>
@@ -102,22 +102,22 @@
                          class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-amber-600 hover:bg-amber-50 dark:hover:bg-amber-900/20 transition-colors
                                 disabled:opacity-30 disabled:cursor-not-allowed disabled:hover:text-[var(--text-secondary)] disabled:hover:bg-transparent"
                          :title="(station.recipes && station.recipes.length)
-                            ? '{{ _('Azzera le ricette della stazione') }}'
-                            : '{{ _('Nessuna ricetta da azzerare') }}'">
+                            ? {{ _('Azzera le ricette della stazione')|tojson_attr }}
+                            : {{ _('Nessuna ricetta da azzerare')|tojson_attr }}">
                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M16.023 9.348h4.992V4.356m-.582 9.66a8.25 8.25 0 01-15.356 2.008M3.985 14.652h4.992v4.992m.581-9.66a8.25 8.25 0 0115.356-2.008"/>
                    </svg>
                  </button>
                  <button @click="openEditModal(station)"
                          class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-primary hover:bg-primary-50 dark:hover:bg-primary-900/20 transition-colors"
-                          :title="'{{ _('Modifica') }}'">
+                          :title="{{ _('Modifica')|tojson_attr }}">
                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M11 5H6a2 2 0 00-2 2v11a2 2 0 002 2h11a2 2 0 002-2v-5m-1.414-9.414a2 2 0 112.828 2.828L11.828 15H9v-2.828l8.586-8.586z"/>
                    </svg>
                  </button>
                  <button @click="confirmDelete(station)"
                          class="p-1.5 rounded-lg text-[var(--text-secondary)] hover:text-red-600 hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors"
-                          :title="'{{ _('Elimina') }}'">
+                          :title="{{ _('Elimina')|tojson_attr }}">
                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6M1 7h22M9 7V4a1 1 0 011-1h4a1 1 0 011 1v3"/>
                    </svg>
@@ -160,7 +160,7 @@

      <div class="flex items-center justify-between px-6 py-4 border-b border-[var(--border-color)]">
        <h2 class="text-lg font-semibold text-[var(--text-primary)]"
-            x-text="isEditing ? '{{ _('Modifica Stazione') }}' : '{{ _('Nuova Stazione') }}'"></h2>
+            x-text="isEditing ? {{ _('Modifica Stazione')|tojson_attr }} : {{ _('Nuova Stazione')|tojson_attr }}"></h2>
        <button @click="closeModal()" class="p-1 rounded-lg text-[var(--text-secondary)] hover:bg-[var(--bg-secondary)] transition-colors">
          <svg class="w-5 h-5" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
            <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12"/>
@@ -237,7 +237,7 @@
                :disabled="saving"
                class="px-4 py-2 bg-primary text-white text-sm font-medium rounded-lg
                       hover:bg-primary-700 transition-colors shadow-sm disabled:opacity-50">
-          <span x-show="!saving" x-text="isEditing ? '{{ _('Salva Modifiche') }}' : '{{ _('Crea Stazione') }}'"></span>
+          <span x-show="!saving" x-text="isEditing ? {{ _('Salva Modifiche')|tojson_attr }} : {{ _('Crea Stazione')|tojson_attr }}"></span>
          <span x-show="saving" x-cloak>{{ _('Salvataggio...') }}</span>
        </button>
      </div>
@@ -299,7 +299,7 @@
                          :disabled="saving"
                          class="ml-2 inline-flex items-center gap-1 px-2.5 py-1 bg-primary text-white text-xs font-medium rounded-md
                                 hover:bg-primary-700 transition-colors shadow-sm disabled:opacity-50"
-                          :title="'{{ _('Assegna a questa stazione') }}'">
+                          :title="{{ _('Assegna a questa stazione')|tojson_attr }}">
                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" stroke-width="2.5" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M12 4v16m8-8H4"/>
                    </svg>
@@ -332,7 +332,7 @@
                  <button @click="unassignRecipe(r.id)"
                          :disabled="saving"
                          class="ml-2 p-1.5 rounded-md text-[var(--text-secondary)] hover:text-red-600 hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors disabled:opacity-50"
-                          :title="'{{ _('Rimuovi assegnazione') }}'">
+                          :title="{{ _('Rimuovi assegnazione')|tojson_attr }}">
                    <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                      <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12"/>
                    </svg>